Escolar Documentos
Profissional Documentos
Cultura Documentos
1 BENJAMIN B. WAGNER
United States Attorney
2 MATTHEW D. SEGAL
PAUL HEMESATH
3 Assistant United States Attorneys
501 I Street, Suite 10-100
4 Sacramento, CA 95814
Telephone: (916) 554-2700
5 Facsimile: (916) 554-2900
6 LESLIE R. CALDWELL
Assistant Attorney General
7 United States Department of Justice, Criminal Division
JAMES SILVER
8 Deputy Chief for Litigation
Computer Crime and Intellectual Property Section
9 Washington, DC 20530
Telephone: (202) 514-1026
10
Attorneys for Plaintiff
11 United States of America
12
13
14
15 UNITED STATES OF AMERICA,
Plaintiff,
16
v.
17
18 MATTHEW KEYS,
Defendant.
19
20
21
The United States moves for an in limine ruling on the admissibility of the evidence it will offer
22 to prove the loss element of the charge in Count 2 of the Superseding Indictment. The United States
23 intends to offer evidence that between October 28, 2010 through January 5, 2010, Keyss course of
24 conduct caused loss in the monetary value of the time that salaried employees spent investigating and
25 responding. The proof will be proffered chronologically. First, Fox 40 employees will testify about
26 their time-consuming efforts to identity and stop the perpetrator of attacks that began soon after Keys
27 was fired. At the time, they could not prove Keys was behind the conduct, but in the course of denying
28 responsibility, Keys predicted that Anonymous was going to attack The Los Angeles Times. That
U.S. MIL #1 RE PROOF OF LOSS
During the offense, Fox 40 and the The Los Angeles Times were both part of Tribune Company
5 and shared the same network and login credentials. The Superseding Indictment charges that
6 defendants course of conduct lasted between October 28, 2010 and January 5, 2010. (Superseding
7 Indictment at Count 1, 1(h); Count 2, 1-2). The proper inquiry for the jury is what aggregate
8 damage Keys caused in that period. Creative Computing v. Getloaded.com LLC, 386 F.3d 930, 935 (9th
9 Cir. 2004) (The damage floor in the Computer Fraud and Abuse Act contains no single act
10 requirement.).
11
Tribune Company employee time will be valued at hourly rates derived from each employees
12 salary. The Ninth Circuit has approved this proof method. See United States v. Middleton, 231 F.3d
13 1207, 1214 (9th Cir. 2000). Costs associated with investigating intrusions into a computer network and
14 taking subsequent remedial measures are losses within the meaning of the statute. Multiven, Inc. v.
15 Cisco Sys., Inc., 725 F. Supp. 2d 887, 895 (N.D. Cal. 2010).
16
This all occurred within the course of conduct and caused by it. The Superseding Indictment
17 expressly alleges that after he was fired, but before he made contact with Anonymous, Keys kept and
18 used for malicious purposes login credentials to Tribunes server. (Superseding Indictment at Count 1,
19 1(h); Count 2, 1-2). For example, Keys repeatedly deactivated his replacements login credentials.
20 (She will also testify about her own lost time and its value.) Keys sent a command to Tribune
21 Companys server to download Fox 40s list of about 20,000 viewers who had signed up for an affinity
22 program and then used that list to send spam to Fox 40s viewers. Once Keys gained access to the
23 Anonymous IRC channel, he actually offered the list to Anonymous.
24
Witnesses Brandon Mercer and Jerry Del Core will testify that as Fox 40 employees, they spent
25 scores of hours trying to identify the source of the network breach and stop it. They did this in meetings
26 among management, counsel, and law enforcement. Mercer even had consensually recorded meetings
27 with Keys in order to help the FBI figure out if Keys was the one behind the theft and misuse of Fox
28 40s contact list. These efforts were all expended during the time period charged in Count 2 and will be
U.S. MIL #1 RE PROOF OF LOSS
Witnesses Tim Rodriguez, Tom Comings, and Dylan Kulesza will testify that once an editor of
3 The Los Angeles Times discovered that a story had been defaced, they spent scores of hours responding.
4 They will assess a monetary value to their time based on their salary.
5
This proof method is entirely conventional and the United States therefore asks for an in limine
Respectfully submitted,
BENJAMIN B. WAGNER
United States Attorney
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
U.S. MIL #1 RE PROOF OF LOSS
12
13
14
15
16
17
v.
MATTHEW KEYS,
Defendant.
18
19
20
I.
INTRODUCTION
The United States requests an in-limine ruling admitting into evidence a summary of voluminous
21
22 evidence.
23
24
II.
FACTS
While assembling its case-in-chief, the government has reviewed several categories of
25 voluminous evidence, including computers, external hard drives, and server logs which, if printed to
26 paper, would consume tens of thousands of pages. Moreover, some of this evidence is in a challenging
27 format, rendering its examination unusually difficult.
28
In order to distill this evidence into a comprehensible summary, the government has created a
GOVERNMENTS MOTION IN LIMINE
III.
LAW
A. Federal Rule of Evidence 1006 Permits the Use of A Summary to Prove the Content of
Voluminous Writings That Cannot Be Conveniently Examined in Court.
Federal Rule of Evidence 1006 (Summaries to Prove Content) provides:
The proponent may use a summary, chart, or calculation to prove the content of
voluminous writings, recordings, or photographs that cannot be conveniently examined in
court. The proponent must make the originals or duplicates available for examination or
copying, or both, by other parties at a reasonable time and place. And the court may
order the proponent to produce them in court
9
10
The Ninth Circuit has recognized that summary evidence can help the jury organize and
11 evaluate evidence which is factually complex and fragmentally revealed in the testimony of the
12
13
14
15
16
multitude of witnesses. United States v. Shirley, 884 F.2d 1130, 1133 (9th Cir. 1989) (quoting United
States v. Lemire, 720 F.2d 1327, 1348 (D.C. Cir. 1983)); see also United States v. Meyers, 847 F.2d
1408, 1412 (9th Cir. 1988) (approving the use of a summary witness where the sequence of events was
confusing and the chart contributed to the clarity of presentation). Such summaries are admissible
th
17 evidence. Meyers, 847 F.2d at 1412; United States v. Wood, 943 F.2d 1048, 1053 (9 Cir. 1991).
18
Although the underlying materials upon which the summary testimony is based must be
19 admissible and available for inspection, they need not be actually admitted into evidence. Meyers,
20
21
22
23
847 F.2d at 1412; United States v. Johnson, 594 F.2d 1253, 1257 n.6 (9th Cir. 1979). The foundation
for admission of such a summary is simply that the records are voluminous and that in-court
examination would be inconvenient. United States v. Duncan, 919 F.2d 981, 988 (5th Cir. 1990). If the
24 underlying documents are themselves admissible, they need not be in evidence for a summary witness to
25 describe them and admit the summary of voluminous records. Fed. R. Evid. 1006.
26
The summary witness may review the evidence in a manner that advocates the Governments
27 theory of the case, and need not give effect to the contentions of the defendant. United States v. Moore,
28
GOVERNMENTS MOTION IN LIMINE
A district courts decision to admit a summary under Rule 1006 is reviewed for abuse of
discretion. United States v. Anekwu, 695 F.3d 967, 982 (9th Cir. 2012).
6
7
8
B. The Records Underlying the Summary Are Admissible, Voluminous, and Would Be
Inconvenient to Examine In Court.
The summary draws from multiple hard drives seized by the Federal Bureau of Investigation, as
10 well as server logs obtained from a victim company, third-party business records, and the anticipated
11 testimony of a trial witness who will precede the introduction of the summary.
Each of these categories of evidence is admissible. A stipulation of the parties filed in this case
12
13 (Document 66) established the authenticity and admissibility, subject only to a showing of relevance, of
14 the third-party business records and victim server logs that partially underlie the summary. Subject to
15 ongoing discussions about additional stipulations and the resolution of a pending motion to quash, the
16 government plans to admit the remaining categories of underlying records through the testimony of trial
17 witnesses with personal knowledge.
The summary draws from voluminous hard drives and server log files that would be
18
19 inconvenient to examine in court, and would total in the tens of thousands of pages if printed to paper.
20 In light of the unusual formatting of certain of these files, it has been inconvenient to review them even
21 in specialized computer forensic facilities.
Finally, the defense has been provided with the records underlying the summary, and will have
22
IV.
CONCLUSION
As the underlying records are admissible, voluminous, and would be inconvenient to examine in
court, the Court should admit into evidence the attached summary.
27
28
GOVERNMENTS MOTION IN LIMINE
LESLIE R. CALDWELL
Assistant Attorney General
3
By: /s/ JAMES SILVER
JAMES SILVER
Deputy Chief for Litigation
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
GOVERNMENTS MOTION IN LIMINE
13
14
15 UNITED STATES OF AMERICA,
Plaintiff,
16
v.
17
18 MATTHEW KEYS,
Defendant.
19
20
21
The United States moves for an order barring evidence and argument regarding how or whether
22 other computer hackers who were charged and how any cases were resolved, unless for the purpose of
23 impeaching a witness who was convicted. This case is one of a number that resulted from a wave of
24 hacking attacks by persons associated with Anonymous. In the United States and elsewhere, law
25 enforcement succeeded in identifying and prosecuting people. But the Governments prosecutive
26 decisions in other cases are irrelevant to whether Keys is guilty of the crimes alleged in the Superseding
27 Indictment.
28
Such evidence or argument could only suggest that there was selective prosecution of the
U.S. MIL #3 TO BAR EVIDENCE OF OTHER HACKING
PROSECUTIONS
Of course, if Defendant actually calls convicted members of Anonymous, he may impeach them
9
10 Dated: September 9, 2015
BENJAMIN B. WAGNER
United States Attorney
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
U.S. MIL #3 TO BAR EVIDENCE OF OTHER HACKING
PROSECUTIONS
13
14
15 UNITED STATES OF AMERICA,
Plaintiff,
16
v.
17
18 MATTHEW KEYS,
19
Defendant.
20
21
The United States intends to offer excerpts of the statement that Defendant made when agents
22 executed a search warrant at his residence and moves for a finding that the attached selected excerpts are
23 sufficiently complete so as not to be misleading and require supplement.
24
Offered by the United States, these out-of-court statements are admissible as statements of a
25 party opponent. Fed. R. Evid. 801(d)(2)(A). If offered by the Defendant, these statements would be
26 inadmissible hearsay. Fed. R. Evid. 801(c), 802. See, e.g., United States v. Mitchell, 502 F.3d 931, 96427 965 (9th Cir. 2007) (These statements [by defendant] were inadmissible
28 hearsay; as [defendant] was attempting to introduce them himself, they were not party-opponent
U.S. MIL #4 TO ESTAB. COMPLETENESS OF EXCERPTS
OF DEFENDANTS STATEMENT
If the Government publishes the attached excerpts, the Rule of Completeness, Fed. R. Evid. 106,
8 does not provide the Defendant a route to offering his own hearsay into evidence. The Ninth Circuit
9 teaches, The Rule [of Completeness] does not . . . require the introduction of any unedited writing or
10 statement merely because an adverse party has introduced an edited version. United States v. Vallejos,
11 742 F.3d 902, 905 (9th Cir. 2014). It is not proper to allow a Defendant to bring in un-cross-examined,
12 self-exculpating hearsay in the guise of presenting the flavor of the interview. Id. Rather, if the
13 complete statement does not serve to correct a misleading impression in the edited statement that is
14 created by taking something out of context, the Rule of Completeness will not be applied to admit the
15 full statement. Id. Rule 106 does not compel admission of otherwise inadmissible hearsay
16 evidence. United States v. Collicott, 92 F.3d 973, 983 (9th Cir. 1996).
17
The Government has not yet finished marking its exhibits and choosing what excerpts to offer.
18 Attached to this motion a transcript of the complete statement of the Defendant with the currently
19 planned excerpts marked in yellow highlight. In the interest of avoiding trial surprise and delay, the
20 United States asks for a ruling that each of the highlighted excerpts does not convey a misleading
21 impression by taking things out of context, and may therefore be admitted into evidence without
22 supplement.
23
Respectfully submitted,
BENJAMIN B. WAGNER
United States Attorney
25
26
27
28
U.S. MIL #4 TO ESTAB. COMPLETENESS OF EXCERPTS
OF DEFENDANTS STATEMENT
12
13
14
15
16
17
v.
MATTHEW KEYS,
Defendant.
18
19
I.
INTRODUCTION
The United States requests an in-limine ruling barring Defendant Matthew Keys from presenting
20
21 the testimony of any witnesses in support of an alibi defense as to the six particular acts described in
22 Exhibit A hereto.
23
24
II.
FACTS
On March 26, 2015, the government emailed the defense a letter requesting notice of any alibi
25 defense for six specific acts. (Exh. A.) A table contained in the letter specified the time, date, and place
26 of the acts. (Id.) On April 20, 2015, having received no response from the defense, the government
27 emailed the defense to ask whether it intended to respond, or sought additional time. The defense asked
28 if it could have until the end of the week, and the government agreed to this extension. This was the last
GOVERNMENTS MOTION IN LIMINE
III.
LAW
A. Federal Rule of Criminal Procedure 12.1 Requires the Defense, Upon the Governments
Request, to Provide Written Notice of Intent to Offer an Alibi Defense.
Rule 12.1(a) (Governments Request for Notice and Defendants Response) provides:
(1)
Governments Request. An attorney for the government may
request in writing that the defendant notify an attorney for the government of any
alibi defense. The request must state the time, date, and place of the alleged
offense.
(2)
Defendants Response. Within 14 days after the request, or at
some other time the court sets, the defendant must serve written notice on an
attorney for the government of any intended alibi defense. The defendants notice
must state:
(A) each specific place where the defendant claims to have been at the
time of the alleged offense; and
(B) the name, address, and telephone number of each alibi witness on
whom the defendant intends to rely.
13
14
15
16
17
B. If A Party Fails to Comply With the Rule, the Court May Exclude the Testimony of
Any Undisclosed Alibi Witness.
Federal Rule of Criminal Procedure 12.1(e) (Failure to Comply) states that [i]f a party fails to
comply with this rule, the court may exclude the testimony of any undisclosed witness regarding the
defendants alibi. This rule does not limit the defendants right to testify.
18
19
20
21
22
23
24
25
26
27
28
C. As Defendant Has Failed to Comply with the Rule, the Court Should Exclude the
Testimony of Any Alibi Witnesses Whose Testimony Would Pertain to the
Governments March 26 Request.
The purpose of Rule 12.1 is to prevent a defendant from surprising the government with alibi
testimony. In Wardius v. Oregon, 412 U.S. 470, 473, 93 S.Ct. 2208, 2211, 37 L.Ed.2d 82 (1973),
explained that notice-of-alibi rules
are based on the proposition that the ends of justice will best be served by a system of
liberal discovery which gives both parties the maximum possible amount of information
with which to prepare their cases and thereby reduces the possibility of surprise at trial.
The Advisory Committee Notes to the rule further explain:
Rule 12.1 will serve a useful purpose even though rule 16 now requires disclosure of the
GOVERNMENTS MOTION IN LIMINE
names and addresses of government and defense witnesses. There are cases in which the
identity of defense witnesses may be known, but it may come as a surprise to the
government that they intend to testify as to an alibi and there may be no advance notice
of the details of the claimed alibi. The result often is an unnecessary interruption and
delay in the trial to enable the government to conduct an appropriate investigation. The
objective of rule 12.1 is to prevent this by providing a mechanism which will enable the
parties to have specific information in advance of trial to prepare to meet the issue of alibi
during the trial.
2
3
4
5
8 defendants from calling undisclosed alibi witnesses. United States v. Henderson, 241 F.3d 638, 650 (9th
9 Cir. 2000) (defense alibi witness not disclosed until third day of four-day trial); United States v.
10 Benavidez, 992 F.2d 1220 (Table), 1993 WL 131217, *1-2 (9th Cir. 1993) (defense provided no alibi
11 notice); United States v. Barron, 575 F.2d 752, 755-58 (9th Cir. 1978) (defense alibi witness disclosure
12 came one day late).
The Henderson court further held that a district court does not err by not requiring any showing
13
14 of surprise or prejudice to the government. A trial court may reject testimony of an alibi witness when it
15 finds that the defendant has willfully failed to follow procedural rules applicable to the presentation of
16 such evidence. Henderson, 241 F.3d at 650 (citing Taylor v. Illinois, 484 U.S. 400, 414-15, 108 S.Ct.
17 646, 98 L.Ed.2d 798 (1988)).
18
19
IV.
CONCLUSION
As the defense has apparently made a considered decision not to present an alibi defense, and the
20 Government has relied on that decision under the applicable rule, the United States asks the Court to bar
21 the defense from presenting the testimony of witnesses in support of such a defense.
22
23
24
LESLIE R. CALDWELL
Assistant Attorney General
25
By: /s/ JAMES SILVER
JAMES SILVER
Deputy Chief for Litigation
26
27
28
GOVERNMENTS MOTION IN LIMINE
13
14
15 UNITED STATES OF AMERICA,
Plaintiff,
16
v.
17
18 MATTHEW KEYS,
19
Defendant.
20
21
The United States moves for an in limine order barring Defendant from presenting evidence of
22 victim negligence and barring Defendant from arguing that agents of Tribune Company, Fox 40, and/or
23 The Los Angeles Times were negligent in the way that they operated their computer network.
24
The Ninth Circuit has already rejected the argument that evidence of a victims failure to
25 maintain a secure computer network can be used to excuse computer crime or claim that loss was not
26 caused by a defendant. In Creative Computing v. Getloaded.com LLC, 386 F.3d 930 (9th Cir. 2004),
27 the defendant argued that the plaintiff/victim had failed to install a free operating system patch that
28 would have prevented the whole incident. Id. at 936. The Ninth Circuit rejected such reasoning:
U.S. MIL #6 RE VICTIM NEGLIGENCE
10
11
12
Respectfully submitted,
Dated: September 9, 2015
BENJAMIN B. WAGNER
United States Attorney
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
U.S. MIL #6 RE VICTIM NEGLIGENCE
13
14
15 UNITED STATES OF AMERICA,
Plaintiff,
16
v.
17
18 MATTHEW KEYS,
19
Defendant.
20
21
The United States moves for an order barring evidence and argument about the following: (1)
22 the penalties Defendant will face if convicted, (2) the existence of civil remedies for violation of the
23 Computer Fraud and Abuse Act, (3) Government policies outside the record, and (4) any plea agreement
24 that might have been offered to the Defendant.
25
The United States moves for an in limine order barring Defendant from disclosing to the jury the
26 penalties that the Defendant will face if convicted. [I]t is inappropriate for a jury to consider or be
27 informed of the consequences of their verdict. United States v. Frank, 956 F.2d 872, 879 (9th Cir.
28 1991), as amended on denial of rehg (Feb. 11, 1992). [T]he jury ha[s] no sentencing function and
U.S. MIL #7 TO BAR CERTAIN NULLIFICATION
EV. & ARG.
It is also irrelevant that the Computer Fraud and Abuse Act contains civil remedies not at issue in
10 this criminal trial. [T]he availability of a civil remedy is irrelevant to the issue of criminal liability[.]
11 See United States v. Buras, 633 F.2d 1356, 1360 (9th Cir. 1980); United States v. Sinagra, 584 F. Appx
12 628, 630 (9th Cir. 2014) (CFAA). Putting the possibility of civil suit in front of the jury would confuse
13 them with an irrelevant issue. See Buras, 633 F.2d at 1360.
14
This case is about whether the Defendant committed the acts alleged in the Superseding
15 Indictment. It is not about providing a forum for the Anonymous list of grievances. Defendant should
16 not be able to argue for acquittal based on the United States Governments policies related to Edward
17 Snowden, Julian Assange, or Wikileaks. If the defense makes arguments associating the prosecution
18 with extra-record government policies, the Court should interrupt the argument and correct it. See
19 United States v. Blixt, 548 F.3d 882, 890 (9th Cir. 2008) (When counsel argued the government was the
20 same government prosecuting the Iraq War, the district court, exercising considerable restraint in the
21 face of blatant jury nullification arguments, properly instructed the jury to disregard counsels
22 statements.). Not only should a judge interfere with an attorneys closing argument when it is legally
23 wrong, but [s]he should also limit, for example, attorneys remarks outside the record or unduly
24 inflammatory. See United States v. Sturgis, 578 F.2d 1296, 1300 (9th Cir. 1978).
25 //
26 //
27 //
28 //
U.S. MIL #7 TO BAR CERTAIN NULLIFICATION
EV. & ARG.
Any plea agreement offered by the United States in this case is also irrelevant and inadmissible.
2 What dispositions the Government might have offered years after the offense have nothing to do with
3 non-hearsay evidence of whether the Defendant committed the crimes. See United States v. Fell, 372 F.
4 Supp. 2d 773, 783 (D. Vt. 2005) affd, 531 F.3d 197 (2d Cir. 2008) (It is well settled that a prosecutors
5 belief in the defendants guilt is not relevant.).
6
7
Respectfully submitted,
BENJAMIN B. WAGNER
United States Attorney
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
U.S. MIL #7 TO BAR CERTAIN NULLIFICATION
EV. & ARG.
Exhibit A
1.
2.
3.
4.
5.
6.
From Overplay
IP 75.53.168.11
IP 80.74.135.87
All mkeys entries had the same user agent string indicating use of an Apple computer using a Firefox browser.
The first suspicious email received, asserting that an email list had been stolen by
a person purporting to be foxmulder4099@yahoo.co.uk.
"
75.53.168.11 - - [22/Nov/2010:03:02:36 -0800] "GET /access/emailpage.ui?username=test5678 HTTP/1.1" 200
187976 "https://assembler.tribuneinteractive.com/common/navigation.ui" "Mozilla/5.0 (Macintosh; U; Intel
Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.168.11 - - [22/Nov/2010:03:02:36 -0800] "GET /images/buttons/leftarrow.gif HTTP/1.1" 200 120
"https://assembler.tribuneinteractive.com/access/emailpage.ui?username=test5678" "Mozilla/5.0 (Macintosh;
U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.168.11 - - [22/Nov/2010:03:02:37 -0800] "GET /access/ldap/user/find.jsp HTTP/1.1" 200 3172
"https://assembler.tribuneinteractive.com/common/navigation.ui" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X
10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.168.11 - - [22/Nov/2010:03:02:37 -0800] "GET /images/buttons/ok.gif HTTP/1.1" 200 312
"https://assembler.tribuneinteractive.com/access/emailpage.ui?username=test5678" "Mozilla/5.0 (Macintosh;
U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.168.11 - - [22/Nov/2010:03:02:37 -0800] "GET /images/buttons/rightarrow.gif HTTP/1.1" 200 120
"https://assembler.tribuneinteractive.com/access/emailpage.ui?username=test5678" "Mozilla/5.0 (Macintosh;
U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.168.11 - - [22/Nov/2010:03:02:43 -0800] "POST /access/ldap/user/finduser.ldap HTTP/1.1" 200 3478
"https://assembler.tribuneinteractive.com/access/ldap/user/find.jsp" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X
10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
These are more log entries showing references to emailpage from the IP
associated with mkeys, and the mkeys user agent string. The date is
November 22, 2010. The associated username is test5678.
The first suspicious email received, asserting an email list had been stolen by
a person purporting to be foxmulder4099@yahoo.co.uk.
December 3, 2010
December 4, 2010
December 4, 2010
December 4, 2010
December 5, 2010
December 5, 2010
December 6, 2010
December 6, 2010
10:47 PM
1:45 AM
5:35 AM
4:28 PM
2:07 AM
8:46 PM
1:53 AM
6:48 AM
IP address 91.214.168.172 alternates between logging into the Tribune server and the
foxmulder4099 email account.
Observation
December 6, 2010
09:53 AM 12 MIN EARLY
keysjom | 91.214.168.172 | 2010-12-06 10:05:49 | 2010-12-06 10:13:35 | 10.10.0.234
December 6, 2010
04 46 AM 2 MIN EARLY
keysjom | 91.214.168.172 | 2010-12-06 04:48:48 | 2010-12-06 05:05:41 | 10.10.0.234
December 5, 2010
10 07 AM 15 MIN EARLY
keysjom | 91.214.168.172 | 2010-12-05 10:22:09 | 2010-12-05 10:27:44 | 10.10.0.234
December 5, 2010
00: 28 AM 15 MIN EARLY
keysjom | 91.214.168.172 | 2010-12-05 00:43:06 | 2010-12-05 00:57:58 | 10.10.0.234
December 4, 2010
13: 35 PM 12 MIN EARLY
keysjom | 91.214.168.172 | 2010-12-04 13:47:49 | 2010-12-04 14:01:09 | 10.10.0.234
December 4, 2010
09: 45 AM - 10 MIN EARLY
keysjom | 91.214.168.172 | 2010-12-04 09:55:00 | 2010-12-04 10:46:11 | 10.10.0.234
| 75.53.168.11
| 75.53.168.11
| 75.53.168.11
| 69.106.226.212
| 69.106.226.212
| 69.106.226.212
| 69.106.226.212
December 4, 2010
07: 04 AM - in Range with 11 MIN TO SPARE or 14 MIN EARLY
keysjom | 91.214.168.172 | 2010-12-04 06:29:44 | 2010-12-04 07:15:17 | 10.10.0.234 | 69.106.226.212
keysjom | 91.214.168.172 | 2010-12-04 07:18:36 | 2010-12-04 07:25:01 | 10.10.0.234 | 69.106.226.212
December 6, 2010
14 48 PM - -13 MIN EARLY
keysjom | 91.214.168.172 | 2010-12-06 15:01:06 | 2010-12-06 15:07:31 | 10.10.0.234
| 69.106.226.212
* If 15 min is subtracted for each log entry of Overplay computer 91.214.168.172, the times match. So, for this IP the clock
should be subtracted by 15 minutes.
December 4, 2010
06:47 AM In Range with 28 MIN TO SPARE
keysjom | 91.214.168.172 | 2010-12-04 06:29:44 | 2010-12-04 07:15:17 | 10.10.0.234
Summary
About two hours later, Cohen reported that her new account
and old account were no longer accepting her log on
information.
In summary,
75.53.171.204 - - [02/Jan/2011:05:02:59 -0800] "GET / HTTP/1.1" 200 1781 "-" "Mozilla/5.0 (Macintosh; U;
Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.171.204 - - [02/Jan/2011:05:02:59 -0800] "GET /stylesheets/ui.css HTTP/1.1" 200 7252
"https://assembler.tribuneinteractive.com/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US;
rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.171.204 - - [02/Jan/2011:05:03:00 -0800] "GET /favicon.ico HTTP/1.1" 200 3574 "-" "Mozilla/5.0
(Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.171.204 - - [02/Jan/2011:05:03:00 -0800] "GET /images/buttons/login.gif HTTP/1.1" 200 334
"https://assembler.tribuneinteractive.com/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US;
rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.171.204 - - [02/Jan/2011:05:03:00 -0800] "GET /images/ti.jpeg HTTP/1.1" 200 17924
"https://assembler.tribuneinteractive.com/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US;
rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.171.204 - - [02/Jan/2011:05:03:03 -0800] "GET /favicon.ico HTTP/1.1" 200 3574 "-" "Mozilla/5.0
(Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.171.204 - - [02/Jan/2011:05:03:04 -0800] "POST /access/loginmodule.ldap HTTP/1.1" 200 1859
"https://assembler.tribuneinteractive.com/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US;
rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
75.53.171.204 - - [02/Jan/2011:05:03:07 -0800] "GET /favicon.ico HTTP/1.1" 200 3574 "-" "Mozilla/5.0
(Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8"
Dec 13 03:09:48 * *** Notice -- Client exiting at fancy.anonops-irc.com: AESCracker!AESCracker@75-53-171-204.lightspeed.nscrca.sbcglobal.net (Ping timeout)
| 75.53.171.204
From Overplay:
Summary
The image depicted data that came from the Tribune Server on
December 11, 2010.
The image was obtained by the user of IP address
91.214.168.172.
IP address 91.214.168.172 was assigned to Matthew Keys
(keysjom) who accessed it from his home in Sacramento.
The image was found on Matthew Keyss computer.
#Target
#OperatonPayback
Dec 09 07:54:12 * EvilBoat has kicked teddde from #OperationPayback (Watch your language!)
Dec 09 07:54:12 <odalfe> !botnum
Dec 09 07:54:13 * EvilBoat has kicked odalfe from #OperationPayback (Watch your language!)
Dec 09 07:54:15 <paull> can someone pm me what has happened the last about 5 hours please Dec 09 07:54:15
<amanikos> paypal ha
Dec 09 07:54:17 <AESCracked> I've already given Ops the user/pass to several FOX websites.s slowed down or is
it me?
Dec 09 07:54:17 <aveit23> !botnum
Dec 09 07:54:18 * EvilBoat has kicked aveit23 from #OperationPayback (Watch your language!)
Dec 09 07:54:18 <ziltoid> only fire where we need to, we'll probably be jumped back to mastercard.com later
Dec 09 07:54:19 <Anonlolle> Fox News is just for the lulz and the white trash trailer rage
Dec 09 07:54:21 <JAM> !botnum Dec 09 07:54:21 * EvilBoat sets ban on *!*@IT.IN
Dec 09 07:54:21 * EvilBoat has kicked JAM from #OperationPayback (Watch your language!)
Dec 09 07:54:21 <gewgahs_> can anyone link me to instructions for hiding LOIC from my ISP? I've got plenty of
bandwidth to spare Dec 09 07:54:21 <calatalee> >####On behalf of #propaganda please spread
http://pastebin.com/XYSN27EK to your local news media####< Dec 09 07:54:22 <AESCracked> The backend of
their CMS.
#OperationPayback
#OperationPayback
#Internetfeds
#OperationPayback
O FFICIAL R ECORD
08/05/2013
Investigation on
File #
by
10/04/2012
at
288A-SC-45485, 288A-LA-258500
Date drafted
07/18/2013
CAUTHEN JOHN M
This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its contents are not
to be distributed outside your agency.
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
2 of 86
talk to a lawyer for advice before you ask questions. You have a right to a
lawyer during your questioning. If you cant afford a lawyer, one will be
appointed to you before any questioning. And, if you decide to answer
questions now, at any point, you have the right to stop. Ok?
MK: Yea.
GA: And, this is all something wed read if you were to be under arrest.
Again, youre not. [UI]
MK: Before we all start.
JC: Tell you what, were going to answer all of your questions. I can tell
youre kind of [UI] unease a little bit.
MK: I had people wake me up in the middle of the night. [Laughter]
JC: And, and thats completely understandable. So, were just, were just
going to [UI]. Uh, by the way, Im John Cauthen. You probably recognize
[UI]
MK: Matthew. I have spoken with you before.
JC: You have.
MK: Yes, I have.
JC: So, Ill tell you what.
MK: Four stories and not.
JC: What we want to do here is put you at ease. Answer all of your
questions.
MK: Mmm hmm.
JC: And, uh, and I think we want to work with you on this, ok? Cause I
think you have a lot of things you want to tell us, and well explain
everything to you. Alright?
GA: [UI]
JC: What we want to do is
MK: Ummm.
JC: -- take you to a place where youre not with your roommates and [UI]
for you.
, On
10/04/2012
, Page
3 of 86
for you.
MK: You know what, we can do either. It doesnt matter to me.
JC: Ok, well, what are you more comfortable with?
MK: I am
JC:Ill tell you what, you know what. Lets go to another location. Just to
make it easy for . They got another room, I think. And then
MK: I, I think I would rather be here.
JC: Ok.
MK: If thats ok.
JC: Ok, then thats what we want to do. Alright. You want to do it in this
room? Or?
MK: We can do it in here if you like as long as I dont have anything to be
worried about. And, I dont, I want to make sure you guys dont have
anything youre worried about.
JC: Well, uh
MK: Well be ok.
JC: I think we cleared the room. Do you have anything dangerous in the room
or anything?
MK: No.
JC: Ok. Do you have a chair or something we can sit on or?
MK: I dont. We can grab one from the dining room.
JC: Thank you. Lets get some chairs. Im going to take my jacket off if
thats ok.
MK: And, I apologize for the mess.
JC:Oh, I understand. And, youve only been here about a month as I
understand? Is that right?
GA: [UI]
JC: So, uh.
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
4 of 86
, On
10/04/2012
, Page
5 of 86
MK: Yea.
GA: In the back she actually, as you mentioned here briefly, that, you know
Keys was invited to observe the goings on in the InternetFeds room December
2010 to January 2011 using the name AESCRACKED. You, uh, provided her a
number of logs to help her with [UI].
[UI Portion 00:00:09 seconds]
GA: -- She picked it up from your logs.
MK: I think she picked it from the logs.
JC:So, you just gave her the raw logs showing it was AESCRACKED and all the
chats with everything?
MK: I gave her some of the raw chat logs, correct.
JC: Ok. Oh, some of them. So, you didnt give her everything? Alright.
MK: I dont remember if I gave her everything that I had.
JC: Alright.
MK: I took quite a few logs while I was, while I was in the chat room.
JC: Well, weve got a number of the logs in there, uh, as well, that youre
going to be able to read.
MK: I saw some of those [UI].
JC: I think thats from your But, weve actually got the raw cuts. We got
the whole thing, essentially is the bottom line. Uh, your conversation.
GA: When you were doing this, did you use other usernames other than
AESCRACKED?
MK: I may have. To be honest with you, I dont remember.
GA: You dont recall off the top of your head?
MK: I, I It happened a year and a half ago.
JC: Yea.
GA: I understand.
JC: Well, heres what we want to do here today, Matt. We want your help in
terms of
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
6 of 86
JC: Well, heres what we want to do here today, Matt. We want your help in
terms of
MK: There were some on one page that I saw here. The first or second page
and [UI].
JC: Theres a probable cause statement that shows some of the logs. This is
not everything obviously. And, items that were going to be taking.
MK: These are not me.
JC: Ok.
MK: Um.
GA: Right.
JC: Well, thats why we want And, some of those people you actually did
talk to those people and thats a large part of why were here today.
MK: Like some of these names I dont even recognize.
JC: And, thats why we want to talk to you, too. Because, you know, there
still are people out there.
MK: Yea.
JC: And, youve heard about Sabu, and all of those guys that have been
wrapped up and a lot of the folks overseas. And, you did have some
involvement with those folks so were going to ask for two things. One is
were going to ask for your help in what you can help us with on those
folks. Two is and this is extremely important and were going to ask for
extreme candor. I mean, we want you to be truthful and not mislead us. And,
I dont think youre going to want to do that.
MK: Define extreme candor.
JC: Well, not trying to lie. I dont think youre going to do that. You
dont seem like the kind of guy who wants to do that, and I think what
happened in the past was just a mistake and youre going to want to move
past that and help us out. Am I, am I right in that?
MK: Yea.
JC: Ok. So, so that
MK: What are the consequences?
JC: Well, I mean, you can read that I dont, I dont know what the
, On
10/04/2012
, Page
7 of 86
JC: Well, I mean, you can read that I dont, I dont know what the
consequences are. I mean, heres the bottom line. Well cover the whole
thing, but the bottom line is weve got two issues. Uh, the first issue is
how you helped these guys in Anonymous. They actually did cause some
damage. No, you didnt actually do the hack, but you did give them the
passwords to Fox, to the CMS. And, and thats an issue we got to address.
And, so were going to expect you be candid about that because we got those
records, and we can prove that. You understand?
GA: Youll be able to keep this, by the way. So this [UI].
JC: Yea, this is your copy.
GA: But, youll have this when we leave.
JC: So
MK: Remind me again what your name was?
GA: Its Gabriel.
JC: Its Gabe. Gabriel.
JC: Im John.
JC: Youre not going to forget that.
MK: No, your name I know who you are.
JC: I know.
MK: Yea.
JC: So
MK: What do you do Gabriel?
GA: Um, same thing as John, basically.
MK: Ok.
JC: But, heres the thing, I mean we, we already know in the scheme of
things where you stand and how you can help us, and thats all were going
to ask you. Just, you know, how can you help us. Were going to ask for,
you know, we got a search warrant actually to get all of the logs off your
computer. Ok. But, its going to help us a lot if you just tell us where
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
8 of 86
computer. Ok. But, its going to help us a lot if you just tell us where
those logs are. If theres more. If youve got them in the cloud, or if
youve just got them on the computer.
MK: I can give you, um, as far as. There, there is a hard drive that, um,
has a zip file with the logs that I kept that I, I remind, you know, I
JC: Ok. Yea.
MK: This computer I didnt own at the time if you want to take a look at
it.
JC: Alright.
MK: I mean youre going to anyway. Uhm
JC: Is the zip file encrypted, or?
MK: No.
JC: So, its a straight. Where is that hard drive?
MK: I believe its in there.
JC: Ok. So, you know what were going to do.
MK: And, I can show you on the computer how to get access to those.
JC: Ok. Well, trust me when I say I dont want to turn your life upside
down and make this more difficult for you than it is cause I understand
that youre probably mildly upset. But, well work with you on it, ok? To
the extent that we can leave you with this computer, well do that. And,
well get those logs because thats all were really asking for and then
your cooperation. And, then finally, uh, you know, we dont want any
minimization in terms of what your role was, you know. Sometimes people do
have a tendency to, uh, kind of minimize what they did. And
MK: I dont know anything about computer hacking.
JC: I know.
MK: Thats the [UI].
JC: And, we believe that. We believe that. Having said that, it did happen,
and it wouldnt have happened without your help. So, we need you to take
, On
10/04/2012
, Page
9 of 86
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
10 of 86
, On
10/04/2012
, Page
11 of 86
JC: Yea.
UM1: Find out what the interface is just so I know.
JC: Yea.
UM1: [UI]
JC: Ill get the [UI]. Ill get the hard drive and bring it out.
UM1: And, theres another Apple in the closet.
JC: Oh ok. [UI] Its, its going to be fine.
UM2: [UI]
JC: Oh yea, Ill ask him if he wants [UI]. So, what do we got in the
fridge? Coke, something?
UM2: [UI]
JC: Alright.
UM2: [UI]
JC: Alright.
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
12 of 86
UM2: [UI]
JC: Sorry about that. Did you want something to drink, Matt? Or some water?
I know theres a Coke in the fridge or something.
MK: No, but in the fridge theres a water jug thats got a red cap on it.
JC: Can I get that for you?
MK: Yes, please.
JC: Alright. Water bottle in the fridge, red cap.
[Pause 00:00:36 seconds]
MK: [UI] water.
JC: [Laughter]
MK: [UI]
(FBI Note: About this time the second recording commenced Evidence Item
1D1)
JC: Its alright.
MK: Um, otherwise, right now I probably would have helped. Um. One of the
things that I did before I joined Reuters was I invited him to have coffee.
Tribune Company [UI] Reuters client. Um, I decided that if I were to get
the job at Reuters I would want there to be some closure and as little
animosity as possible. So, I invited him out, and we didnt talk, you know,
about anything other than the industry, what was happening at the station,
what was going on with what I was doing. At the time I worked at ABC. And,
um, I think it was very cordial. We left on good terms. I sent him a few
emails and havent heard from him most of the time. Uh, but, some of the
times he was very responsive. You know, I told him, I sent him an email
when I started at Reuters saying this is my mailing address, Im still
getting mail to my old address, you need to have these for your records.
GA: Ok.
MK: Um, so I would say that when my employment ended, it ended kind of
gruff. And, then, it eventually, you know. It got better. Time, time makes
everything better. So
GA: Sure. Ok. So, that happened about when then? You came out here sometime
around January, right?
, On
10/04/2012
, Page
13 of 86
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
14 of 86
, On
10/04/2012
, Page
15 of 86
MK: Yea.
JC: You left, and so, the first thing I noticed is we had this issue with
the email or there was an argument with Brandon about the Facebook and
Twitter accounts. And, then you had an issue, and then the emails started.
And, then Anonymous. Now, I want to make sure I got that sequence right.
When you talked, when you first got involved with Anonymous, you know, what
was, what was going on in your mind at the time? And, what happened exactly
in that fall period? In the turmoil of
MK: I was bored and I felt stuck. And, I have always sort of been
interested in trying to get to like the scene of a story.
JC: Mmm hmm.
MK: Or, to the heart of the story.
JC: Mmm hmm.
MK: And, this was a group that I really didnt know a whole lot about. I
kind of learned about it when the rest of common America heard about it.
JC: Sure.
MK: This attack, uh, this PayPal attack on Visa and Mastercard and PayPal
and. Sorry, this WikiLeaks attack on Visa and Mastercard and PayPal. Um,
let me just start off by saying, I have no knowledge of anybody involved in
WikiLeaks. Uh
JC: [Laughter]
MK: I as a journalist have read their material, you know. Um.
JC: Thats fine.
MK: Im not privy to any material that theyre coming out with in the
future. Im not privy to any material [UI]
JC: Were not here for that, obviously. But, I appreciate you mentioning
that.
MK: Just wanted to get that out. Um, so I popped into the chat room that
was a, the generic operational chat room for whatever that happened to be
at the time.
JC: And, did you use, what, did, how did, howd you pop in? I mean are you
a cha-, are you an IRC guy, or how did
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
16 of 86
, On
10/04/2012
, Page
17 of 86
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
18 of 86
, On
10/04/2012
, Page
19 of 86
MK: I didnt want to do the logging because I didnt know what was going to
happen.
JC: Ok.
MK: And, I didnt want anything incriminating left on my computer that you
know could be tied to my name or may not have been tied to my name. I felt
like it was at the time it wasnt a completely rational thought, but I
thought that maybe that would give me an extra layer of protection
JC: Ok.
MK: -- between what they were doing and what I was doing at the time. What
they were doing was
JC: Yes.
MK: -- attempting to do some damage.
JC: Yes.
MK: What I was doing was mainly just being an observer.
JC: Right and that wasnt your intention at that, at that point, certainly.
MK: Eventually, later on, when I did start taking logs, it, I didnt do
those with text either. There might be one or two text logs that I took
just because the data was so gratuitous that there would have been no way
to have captured it in a text file.
JC: Sure.
MK: So, which is why, and I, I know you g-, Ive seen these here. You have
screen grabs that
JC: Your screen grabs. So, you were doing screen grabs.
GA: Look like this
JC: Yea[UI]
MK: You, its harder to manipulate
JC: Yea.
MK: -- an image, and when an image is manipulated you can usually run it
through software and detect whether or not it has.
JC: Mmm hmm.
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
20 of 86
, On
10/04/2012
, Page
21 of 86
because of the debate. Um. That didnt happen two years ago. Instead you
had people actually having a discussion, and in monitoring the discussion
that was going on on Twitter. I mean you still have people that are having
discussion. I dont want to sound, um [rumbling noise]. Whats going on?
JC: I dont know. And, uh, theyre, uh, were not here, theyre not going
wreck it, so dont worry. Itll be
GA: If anything, theyre moving a chair back in towards the table or
something along those lines.
JC: If you want to go out and, and see whats going on, I dont have a
problem with it.
MK: No.
JC: So, uh, you, you, you got it from Twitter, you went to Operation
Payback, youre, youre there.
MK: There Twitter account, there was a Twitter account that had been set
up, and they were mentioning things like the Low Orbit Ion Cannon an, which
I still dont really understand what that is or how that operates orI just
know its a thing.
JC: And, so you didnt do any type of denial of service attacks?
MK: No.
JC: Ok.
MK: No.
JC: So, youre clearly, uh, just at this point really just researching it
and trying to understand where theyre coming from, talk to people. Who did
you meet? Do you remember anybody?
MK: I dont remember anybody that I met in the chat room.
JC: Ok.
MK: I think I was trying to make a little bit of a noise and it, nothing
jumped out. Um.
JC: Hard to do in that group.
MK: Well, its hard to do in general because there was so much interest in
it that you had, you know, that, at the time, I dont think there was like
a press room set up.
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
22 of 86
, On
10/04/2012
, Page
23 of 86
bracing for, and people are like, I knew, I had a feeling it was going to
happen. You know there were changes that were happening at the company.
There were people that were getting let go. A lot of the innovative people
that they brought on initially were being let go. And, um, rightly so, for
reasons that, you know, they should have been let go for, for sending [UI]
emails and for, you know, not meeting certain initiatives. But, I just knew
that there was a cleaning of house that was taking place, and I felt like
at any point Im going to become a victim of this. And, two or three weeks
later it happened.
JC: Sure. So, youre spending a lot of time At some point you did
actually meet some folks though and did get some private message and chats
with folks, uh.
MK: In the chat room?
JC: Well, from the chat room. Or, in the chat room. You were actually
communicating, and
MK: Or on the IRC server well say
JC: Yea.
MK: [UI]. Yea, um, I, I threw something out there in the main chat room,
and I again, forgive, I dont remember what it was.
JC: I understand.
MK: Um, Im sure you have logs of it somewhere.
JC: We do, and I, I dont wanna, uh, prompt your memory. Im trying to get
your recollection, so.
MK: To the extent of you know that I used to work at Fox or, you know, I
have something or other from Fox, or I tried far, to play the Fox, the Fox
part high.
JC: Yea.
MK: And, it was, it was playing to ignorance more than anything because you
I dont want to say too much because my roommate works for Fox.
JC: Right.
MK: But, um.
JC: Its ok
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
24 of 86
, On
10/04/2012
, Page
25 of 86
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
26 of 86
JC: Because you gave them instructions, you walked them through
MK: I
JC: -- how to use it. Do you remember that?
MK: I recall offering some guidance.
JC: Ok.
MK: The other thing is that at, at Tribune at that point anyways things had
been changing so much in terms of our CMS product, our, our online product.
We were re-launching our website every six months when I was there. We were
going from CMS to CMS to CMS.
JC: Ok.
MK: And, at the time
JC: Well, I guess, the only reason Im stopping you is because I dont want
you to go down the path of I didnt think that they were going to do
anything with that because I dont think thats true.
MK: No.
JC: And, I, I dont
MK: But, what, what I thought they were going to do with it is I thought
they would find some use for it.
JC: Ok. Yea.
MK: It wasnt, it wasnt
JC: I mean its not like you expect them to take out the entire network and
destroy the company.
MK: From what, from what I can remember, there was a set of credentials
that I gave them.
JC: Mmm hmm.
MK: That didnt work for me. Um. There were other credentials that I gave
them that did work. Um, that I knew worked and expected them to use. At the
time, though, I was
JC: This was in the first instance that were talking about.
MK: From what I can remember on the first instance.
, On
10/04/2012
, Page
27 of 86
Yea. Because I didnt think that they would work. But, understanding
or maybe the lack of understanding to this matter how hackers work and
the hacking community works. I figured if anybody can figure out how to
these.
JC: Theyre still going to be able to make it efficient. And, that would
build your credibility with the organization, perhaps? Or, is it, or are we
still to screw with Fox or is it a little of both?
MK: I, I [sigh]. I think to be completely honest given the mindset, I think
it was probably a little bit of both.
JC: I understand. I understand. Uh, ok, so were in InternetFeds. Its with
with Sabu. You dont really know how important he is yet.
MK: Im invited into the room that night, the first night that Im on the
chat room. And, I didnt know what I was looking at. There were a lot of
instances where I didnt know what I was looking at. But, my game was to
find out what was going on. Um, my intention quickly shifted from lets
give these hackers who dont get caught and can do some damage something.
JC: Mmm hmm.
MK: It quickly shifted from that to I think I struck upon something here
that people dont know about that maybe people should know about. Um, and,
I couldnt let them see that or know that. Um.
JC: So, was this, is this on the night where they talked about the Gawker
hack and this type of thing. Or, is this, is this a later[UI].
MK: No, I think, I think if I remember correctly the Gawker discussions
came up a few days later.
JC: Yea, ok.
MK: Um, I think what was March 11th that they, not March 11th. It was, um
JC: Like December.
MK: It was like December 11th or December
JC: December 10th or 11th.
MK: You know it was December that they released the Gawker password dump
that Kayla released.
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
28 of 86
, On
10/04/2012
, Page
29 of 86
[Laughter]
JC: Well, you know what, the fact that youre, youre willing to help us
find it on there that goes a long way. I mean, that does go a long way more
than you
MK: John, I remember talking to you in April of 2011. And, you called me as
I was moving.
JC: Yea.
MK: I dont know if you knew at the time that I was moving.
JC: Yea.
MK: Um, you called me as I was moving back in with my grandmother. And, I
remember telling you at the time that, you know, as far as it came to what,
you know, at the time, I was working on a story with The Guardian on what
had happened.
JC: Mmm hmm.
MK: [UI]. Um, but I remember telling you that, you know, whatever you
wanted, what- whatever I could give you, that I would. And, that, you know,
that offer never really was rescinded. It was, it just got to a point where
I started working in San Francisco, and there was no time that I had to
dedicate to that.
JC: I understand.
MK: Please dont take personally the fact that your calls went unanswered
and your emails went unanswered. The other thing was I was trying to figure
out how to handle this. And, I never really got to a point where I could,
you know. I, di- , as a new employee at Disney, its kind of weird to go up
to them and say, I think need some legal counseling on how to handle this
story, you know, that Im not working with on, you know, for your
organization on. That its something that came out of something else.
JC: I understand.
MK: Um.
JC: I mean, you know, Im like you. I mean youre professional. I am a
professional, you know. Im just, uh
MK: The difference is I think you know more about what youre doing than I
did at the time about what I was doing.
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
30 of 86
JC: Ok.
MK: --or I get reprimanded or anything like that.
JC: Yea.
MK: But, its more or less like there are things that, you know, Reuters is
certainly doing things, and I have a certain way doing things and maybe it
doesnt always match, but sometimes
JC: Understandable.
MK: I think they see the incentive in what Im doing. Um, I dont think I
was ever in a position like that with Disney, and so I felt kind of stuck
, On
10/04/2012
, Page
31 of 86
was ever in a position like that with Disney, and so I felt kind of stuck
between this story that, you know, it was never my intention not to
cooperate with people on.
JC: Well, right now youre doing the right thing, and so.
MK: Right now Im doing the right thing
JC: Its
MK: -- for you guys. [Laughter]
JC: Well, it seems that way
MK: [UI] Its necessarily going to be the right thing for
JC: Heres the issue just to put your mind at ease. And, you know, I really
cant put your mind at ease totally. But, uh, everybody appreciates
honesty. Um, and at some point in time, were going to have to show this to
a prosecutor, and its been my experience that prosecutors are people, too.
And, people appreciate honesty. And, you know, some people makes a mistake,
you know, I mean thats, thats human nature. And, you just said that at,
you know, Reuters you make mistakes. People make mistakes. Its, its, its
something that you can work through. So, and in the scheme of things
MK: I would say, before we, before we continue with the, um, Monsegur case.
JC: Mmm hmm.
MK: Fox had that story before anybody else did, and I dont know what, why
that was. But, given that my roommate works at Fox News.
JC: Uh huh.
MK: And, there are FBI agents out on the couch outside.
JC: Uh huh.
MK: Im very uncomfortable with that mix.
JC: Ok. It has nothing to do with that, your, uh, roommate.
MK: No, I understand.
JC; Or, the Fox News. Yea. Im
MK: As an editorial employee, though, you know [UI].
JC: Yea, well, hes not going to see the warrant. He doesnt have a copy of
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
32 of 86
JC: Yea, well, hes not going to see the warrant. He doesnt have a copy of
the warrant.
GA: [UI]
MK: We cant predict whats going to happen.
JC: I cant predict anything.
MK: [Laughter] [UI]
JC: So, you know, heres the
MK: I just wanted to make that clear.
JC: Yea, I understand. You know what, were, our job is not to make news.
Ok?
MK: It doesnt mean it doesnt happen though.
JC: I, I agree, but were, were not going to aggravate the circumstance
with, you know, making news So, whatever happens, happens. Um, and I cant
control the future. Im sorry. I just dont know whats going to happen.
MK: No, I understand. I understand, completely. So, Sabu and I are
chatting. Um, I give him a set of credentials that, frankly, I didnt think
were going to work, but I didnt know. Um, per my recollection, he invites
me to the room. Theres about, I think I did a head count at one point, one
of the hackers executed some command line that showed you all of the people
that had access to that room.
JC: Mmm hmm.
MK: And, there were between 33 and 36.
JC: Mmm hmm.
MK: There is an exact count on one of those logs that shows every username
of every person that has access to that room. And, as far as I can remember
those logs still exist.
JC: Yea, they do. When you saw that, did your heart jump a little bit?
MK: I didnt see it right away.
JC: Oh ok.
MK: I mean its not something that they showed me on the first day.
, On
10/04/2012
, Page
33 of 86
MK: I mean its not something that they showed me on the first day.
JC: Ok.
MK: I can tell you the first couple of days that I was in that room I
didnt sleep well that night.
JC: Because?
MK: I had never been subjected to an environment as a journalist or just
even as a human being. I, I just never seen what I saw in that room before.
It took me aback. I wasnt expecting it.
JC: What was it, what was it? Try to characterize it as best you can that
caused the distress for you.
MK: A group of individuals who could do significant damage who felt free
discussing in the presence of people they didnt know, doing significant
damage and not getting caught.
JC: So, these were people that were malicious, and to a certain extent
MK: I think they were malicious without a cause.
JC: And, and dangerous. [Laughter] To the extent that they were kind of
loose cannons?
MK: What concerned me was, you know, I, I think early on I saw, you know,
and I dont remember if it was that night or if it was, you know, over the
course of a couple of days, but it became very clear to me, and this is
something I told, you know, that I told Parmy, and Ive told a couple of
other people. It became very clear to me that these were the people who
were doing the most damage. The kind of things you would hear about on the
news, you know, which unfortunately, I was not contributing to the news
product at the time. Um, I mean I kind of was, and well get to that in a
second. But, for the most part, I wasnt. Um. It, it was, it [sighs]. A few
things stressed me out. That was, um. I mean its ,its still even just
thinking about it, like the gravity of the skill that was in that room and
blatant disregard for any kind of consequence.
JC: Mmm hmm.
MK: Was just, I had never seen anything before like, like that.
JC: Sure.
MK: I mean, it, it was just, it was something that was incredibly a new
thing.
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
34 of 86
thing.
JC: I understand.
MK: And, part of it was, you know, what could these people find out about
me? You know. Im taking a terrific risk on two levels. One, being there,
with them, taking a risk of, of them doing something. And, two, being there
with them, and, you know, having it come across to the people who enforce
the law.
JC: Sure.
MK: Now, I dont want that to be interpreted as, you know, I knew what he
was doing was breaking the law. I really didnt at the time, you know. My
rationale
JC: But, at some point, you did. But, well get to that later, I suppose.
MK: I think, you know, I [sighs]. I didnt do my research. I messed up
there. I didnt look into it as much as I should have.
JC: Mmm hmm. So, it was like the old boiling frog syndrome where you kind
of just
MK: I dont know what that means, but I started investigating a story
before I did.
JC: You didnt know what you were getting [UI].
MK: [UI]
JC: And, it kind of built, and built, and built, and then before you knew
it, you were.
MK: And, I took some action before I did a proper background on it.
JC: Ok.
MK: My mentality was I have the keys to a house that were never taken away,
you know. And, that was one thing that frustrated me about Tribune is that
there were so many things that should have happened when my employment
ended that didnt happen.
JC: Yea.
MK: You know, they didnt ask for my security key back. And for my house
er, Im sorry into my house into my office. And, they didnt ask for, you
know, they shut down my access to my email, my work email, which was one of
, On
10/04/2012
, Page
35 of 86
know, they shut down my access to my email, my work email, which was one of
the reasons I was upset that day. Um.
JC: But, they didnt take the proper measures for security.
MK: No.
JC: They were very
MK: And, it was one of the things when I was working there I had always
told them they needed to do.
JC: Yea.
MK: You cant let an employee go and have a forward-facing content
management system that anybody can access from the Internet and not take
those credentials away.
JC: Clearly.
MK: I was going in manually as a web producer, and none of my job, my job
is not information technology or anything
JC: Mmm hmm.
MK: --with computers and removing access to these profiles after, aft- long
after people have left , that anybody could get access to, and the company
never seemed concerned about it.
JC: Yea.
MK: Um, and that was frustrating working there.
JC: Sure.
MK: Um, because my concern was always something like, you know, a hacking
attack or, or getting access to information, you know, would compromise the
integrity of the brand, you know. It, it, it would look very bad to our
viewers. It would look very bad to our, our other employees that we looked
like we were incompetent. And, it wasnt because I was incompetent. It
wasnt because my manager was incompetent. It was just because the process,
there really wasnt one, I think, you know, one of a process.
JC: Mmm hmm.
MK: I dont want to ramble on about things that dont matter.
JC: [UI] matters.
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
36 of 86
, On
10/04/2012
, Page
37 of 86
JC: [UI]. Hes talking freely, and uh. Im going to come out with the hard
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
38 of 86
JC: [UI]. Hes talking freely, and uh. Im going to come out with the hard
drive.
UM4: Ok.
JC: As soon as I can get it. But, uh, we dont need to do any searching
UM4: We havent searched anything, so.
JC: Ok.
UM4: There are other computers, laptops, iPads, um.
JC: [UI]
UM4: The roommates say they dont, he doesnt have access to them.
JC: Leave them.
UM4: Alright.
JC: Yea, leave those guys go. Uh, so this guy has been fully cooperative.
So, Im going to get some pictures. Then hes got this laptop which I think
we can take his old laptop. Weve got a new laptop which we may take. And,
then we got this hard drive. Were definitely going to take. Ok? And, uh,
[UI].
UM5: [UI] bring that stuff out
JC: Yea, Im trying to, but uh, I dont want to break the flow.
UM5: Maybe well cut some people loose.
JC: Thats totally acceptable. I would say, yea.
UM5: [UI]
JC: [UI] completely cooperative in there.
UM5: [UI]
JC: Yea, Im just, uh, I can hear the noise out here, and theres a lot of
guys out there. And, he has a roommate.
UM5: [UI]
JC: And, I was thinking that, uh.
MK: [UI] do anything about our neighbors or anything like that?
, On
10/04/2012
, Page
39 of 86
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
40 of 86
get access to the content management system. As far as I know, they didnt
have access to anything internal. And, by internal, I mean, something that
is not forward-facing, something that you would not otherwise be able to
access by the Internet.
JC: Mmm hmm.
MK: Our content management system you could [UI]. Tribunes content
management system you could access through the Internet. Um, again, thats
one of those things I always thought was a flaw on their end, but
regardless. There were actually two content management systems. They were
identical. Um, and they both did the same thing. They both fed into the
same server. The only difference was that one was internal. One was
external. But, they were the exact same thing.
JC: Mmm hmm.
MK: It was just how you got access
JC: Sure.
MK: -- to them was different. Um, but the credentials worked across the
board. The login pages looked identical. Im sure youve seen all of this.
JC: Mmm hmm.
MK: So, um, you know, they were, they, they would tell me that they saw
certain things, that yea, clicked to me, and they told me that they saw
certain things that I didnt even know were in there. Um, it became clear
to me after a while that Tribune must have at some point known that this
username was out in the wild. They were telling me things that even working
at Tribune I had never seen before, but somebody at Tribune had to have
gone on their end and unlocked a lot of doors. Um, it was almost as if, you
know, and please dont take this out of context because I dont know that
this is true, but based on my observations, it was almost like they were
given super user access.
JC: And, that surprised ya.
MK: Well, I had never had it before. [Laughter] So
JC: Yea. So, you gave them the account, and they were, and you were
surprised how effective they were in terms of amplifying it right?
MK: I dont think that anybody who looked at it from the outside wouldnt
have been able to figure out how to turn that on. In my opinion, you know,
again, you guys probably know more than I do. In my opinion, it came across
to me as if somebody at Tribune had turned something on.
, On
10/04/2012
, Page
41 of 86
again, you guys probably know more than I do. In my opinion, it came across
to me as if somebody at Tribune had turned something on.
JC: Ok.
MK: They, they may have done it not knowing the circumstances
JC: Right.
MK: Behind who had access to that account. They may have done it
JC: but somehow this account that you gave them became more powerful than
you thought it was going to be.
MK: Yea.
JC: And, thats what youre telling me.
MK: Yea.
JC: Ok. But, is it that really surprising when youre dealing with these
uber hackers that youre dealing with?
MK: If were going back to the mindset that I had at the time, it did.
JC: Ok.
MK: Um, it really did because you know I, I, I felt uneasy about what I was
seeing, and in the back of my mind I kind of knew.
JC: Kind of an oops moment.
MK: No, no Well, heres, no, what Im trying to get at is You know, the
feeling that I had when I first got into the room of being uneasy and not
being able to sleep the first couple of nights that was prefaced on the
fact that there was appeared to be a blatant disregard for any kind of
civil-civility or any kind of law.
JC: Mmm hmm.
MK: It just seemed to be doing things because they can do things. And, but,
I, I really didnt have a good grasp and still, to this day, dont on what
is possible on their end and what is not. You know, what they had and what
they can do and what they cant do. I, you know, just based on my knowledge
of Tribune and how the Tribune Companys CMS worked, if youre introduced
to a new environment, kind of like I was, you dont inherently know what
youre looking at.
JC: Sure.
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
42 of 86
JC: Sure.
MK: You feel overwhelmed by it, in fact. If its, if you have an abundance
of stuff. And
JC: But, you talked them through it a little bit, I mean in terms of how to
, On
10/04/2012
, Page
43 of 86
MK: And, I dont think I still have access to that. But, I do know its out
there, um. And, I dont know where it is. But, I, I do know it exists
somewhere. I have gone back and looked at it and seen it. Uh, its still
cached on a Google server Im sure.
JC: So, you dont really remember how you thought about it, I guess Im
trying to get a sense of, uh
MK: How I found it was somebody in the chat room linked to it.
JC: Linked to it. And, then, but you know, when, but ultimately you were
responsible for that because thats what Im trying to understand as far as
like, Oo, I wish I hadnt done that, or was there a
MK: I didnt
JC: Not that serious feeling? Or, what were you feeling?
MK: I didnt go into the server and change anything.
JC: So, you felt removed from that?
MK: To be completely honest, I felt like I incited it.
JC: Ok.
MK: But, as far as what they did in the server, or when they had access to
the CMS, you know, I dont recall ever suggesting that they do certain
things.
JC: How do you feel about that now?
MK: Um.
JC: Looking back.
MK: I feel like now it had minimal impact.
JC: Ok.
MK: And, that was something that wasnt really addressed by Tribune. Um,
it, it had very low impact.
JC: Alright.
MK: And, to be honest, I was surprised because this is a group that has
always had high impact. But, what apparently happened was there was one
user in the room. I dont remember what their username was. Its probably
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
44 of 86
user in the room. I dont remember what their username was. Its probably
in the logs, and when I see it, Ill, Ill remember it. There was one
person in the room who took it upon themselves to sort of be a little bit
of individual shenanigans. And, um, it really upset Sabu because Sabu said
he had big plans for those accounts, um, and by those accounts, what I mean
is they eventually, I fully believe, based on the conversations that weve
had within in the room that I wasnt always a part of, but did observe, I
believe they had access to other accounts.
JC: On the CMS?
MK: I dont know how they had access to them.
JC: Mmm hmm.
MK: I really dont know what that process is like. Um, I may have at the
time, but I dont remember what it was like. I, I genuinely dont remember
how to do it now. Um, but, and I wouldnt see why they wouldnt.
JC: Sure.
MK: They had a month to sort of
JC: Work on it.
MK: You know, poke around there. I dont think it was a very high priority
for them. Um, frankly, I think that they, I dont believe Sabu when said
they had big plans for the site. Frankly, I think that they looked at it
and they thought this is really not worth our time. And, the reason why
they let me sort of stay in the room for as long as they did is because
they didnt think that me being involved was going to, uh, let me rephrase
that. They didnt think of me observing them was going to, uh, do any kind
of, have any kind of significant impact on what they were doing. If
anything, I was kind of, if you think of it in terms of a schoolyard group
kind of thing, I was the kid who didnt really know anything, and they
could kind of throw back to it as like, you know
JC: Sure.
MK: This kid didnt know anything but we kind of like being around him. Um,
and that was almost deliberate after a while, you know, uh, I, I did play
to that to find out, you know, sort of how they do certain things. And, I
can already tell you, you know far more about how they do certain things
than I did. I mean that there were things they were trying to explain to me
which just frankly didnt make sense.
JC: Mmm hmm.
, On
10/04/2012
, Page
45 of 86
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
46 of 86
JC: Oh, Im, Im just looking over to see if Gabe [UI}. [Laughter]
MK: Oh, no. Oh, thats fine. Um, forgive me then.
JC: Oh no. You, youre reading things in there that arent there. But, its
ok.
MK: Im reading into a lot of things right now. This is, because Im now
going to have to you know
JC: Process all of it.
MK: Right, you know, uh, and figure out where things go from here. Um, as
far as, the emails it was, I dont think that. It was more or less
hooliganism.
JC: Hooliganism. But, at the same time, you know, I was kind of struck by
that, and I, I, and that makes sense. Uh, so we had the emails you took.
Uh, you did actually contact some folks, you know, and, and screwed things
up there for em. I mean, what was, its just hooliganism? Were you trying
to who, who were you angry at? Was it Brandon Mercer? Was it the company,
in general? Cause
MK: It was, it was
JC: -- because the employees were somewhat terrified, as well, as you would
understand. Or, did you not, were you unaware of this?
MK: There was probably a lot of things that I wasnt aware of that,
frankly, I dont care to know.
JC: Ok. I got to tell ya, I mean a guy like Joseph Huerta. I mean did you
know him?
MK: I did.
JC: What, what were you thinking? Did you want to hurt him?
MK: Um.
JC: Were you angry with him?
MK: There were things that happened during the course of my employment
there, and even afterwards, that you know, he was sort of responsible for.
JC: Uh huh.
MK: And, I genuinely believe that there was an email that came back to me
, On
10/04/2012
, Page
47 of 86
MK: And, I genuinely believe that there was an email that came back to me
about one of my half brothers [UI] found me on the Internet that frankly I
felt he was responsible for.
JC: Ok.
MK: And, still do.
JC: Alright. So
MK: To the extent of that my observation certain [UI] he was using [UI].
Should say certain [UI} he was using.
JC: Right.
MK: Um, [UI] fit.
JC: And, you went through proxy servers for all of that.
MK: Correct.
JC: Now, you said you werent a hacker, per se, but you did understand how
to get a proxy server and how to use it.
MK: I dont understand what proxy server is, like, I,I dont understand the
intricate details of a
JC: But, so when you went to Yahoo! For example
MK: [UI] Let me say this. Its not, I, I dont even know if what I was
using was a proxy server. What I was using was a virtual private connection
JC: Ok.
MK: Virtual private network.
JC: And, how did you set that up?
MK: I paid a company. They gave me software and had access.
JC: What company did you pay?
MK: Its called Overplay.
JC: Overplay.
MK: Yes.
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
48 of 86
MK: Yes.
JC: And, how did you learn about Overplay?
MK: I Googled, um, how to watch British television from the United States?
And, Google, uh, excuse me, Overplay is an, is a service that bills itself
an expatriate service where you can if you was in one country, you can
watch live television or on-demand television from another country. Um, it
dawned on me, um, and forgive me, I dont remember when I signed up for
this service, initially.
JC: Alright.
MK: It dawned on me, though, that the service gave me a different IP
address.
JC: And, did you check these IP addresses to see where they were coming
from?
MK: I dont remember if I did, but I, but they were foreign to me.
JC: Ok.
MK: Um, what I can tell you is that, um, yes, I did, I did check them.
JC: Ok.
MK: In all [UI]. Forgive me for the brain lapse. I ran them through like a
who-is-my-IP-service
JC: Uh huh.
MK: -- to find out if they were coming from the country they said they were
coming from.
JC: Right.
MK: And, what, and how, you know, how they were registered and things like
that. And, this was before my involvement, my observation with Anonymous.
This was, I think I was still working at Fox when I signed up for this
service.
JC: Ok.
MK: And, it was [clears throat]. I was blown away by the fact that you
could do this. I had never known this existed, and frankly, had I known
this existed, I would signed up for it a long time ago.
JC: [Laughter]
, On
10/04/2012
, Page
49 of 86
JC: [Laughter]
MK: You know, for a while, I, I wasnt a customer of theirs after a while.
JC: Right.
MK: And, I recently signed up again when the Olympics happened. Um, because
we needed access to, you know, goo video. And, NBC is [UI]. Um, [clears
throat]. Its totally irrelevant[UI], you asked me.
JC: I, Im getting at you, uh, when youre sending these emails, you knew
you were anonymous and not trackable by Fox News.
MK: I didnt know if I was not trackable. It never occurred to me to
whether or not [clears throat] I was completely, you know, un-trackable.
But, I, I was at least aware that there was an extra layer between me and
anybody else.
JC: Yea. And, at the time, your, its just harassment. What did you hope to
accomplish by doing it?
MK: It wasnt even really harassment. My well
JC: Hooliganism or just defacement or what was
MK: Looking back on it now, thats what I would classify it as. At the
time, though, that wasnt my intent. What my intent was, is, as an angry
former employee was to say to their viewers, Look, this is whats going
on.
JC: Mmm hmm.
MK: And, I remember one of the emails that I sent was about the, its like
an iPad contest, or some kind of contest that was going on that was my
idea, by the way, which Im glad they did. Um, but there was a contest that
was going on, and the contests there are not ethically, um, and maybe not
even legally, um, whats the word? Played, I guess.
JC: Sure.
MK: I mean, for lack of a better word, executed, and [UI]. The-there are
certain practices that they do that Im not sure if theyre illegal or not,
but was a concern to me when I worked there. And, I aired those concerns.
And, I said, Listen, if somebody, you know, gets this out there, this
could be really bad. One of them was, you know, we did a contest called
the Cash Grab. We were one of four TV stations to do this Cash Grab
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
50 of 86
the Cash Grab. We were one of four TV stations to do this Cash Grab
contest where we had like $100,000 and a $1,000,000, in singles and other
denominations that we gave a contestant the ability [UI].
JC: Mmm hmm.
MK: And, they got to keep whatever was left. Turns out, a local politician
was tapped to do that. He won. Um. [Laughter]
JC: [Laughter] What a surprise!
MK: [UI] mean
JC: Yea, I can [UI].
MK: He won fairly, you know. There was no
JC: No, I, I
MK: There was no deception going on there, but what concerned me was that
it became evident to me that management and other employees werent aware
of the fact that we were on a delay on other broadcast services. And, the
reason why I bring that up is because one of the ways that you entered into
this contest was a number flashed on the screen at a certain time.
JC: Uh huh.
MK: And, you call that number, and if you were number x, you know, you
were thrown into this lottery system. And, one person was picked from the
lottery system and thats who got the opportunity to partake in the
contest. None of us thought this contest was a good idea. The employees
were, you know, that participated in it, um, but one of the concerns that I
mentioned was that were on a delay on certain services. You know, when we
air the number on Comcast, on our in-house cable system, uh, or on Comcast,
um, its not going out at the same time as people that are on Dish Network
or DIRECTV.
JC: Mmm hmm.
MK: And, theyre getting it 10, 12, l 15 seconds later. And, theyre not
getting the opportunity to participate, and its simply because the
producers want to get it over with
JC: Yea.
MK: -- as soon as possible. And, had that gotten out you know, it would
have caused a shit storm.
, On
10/04/2012
, Page
51 of 86
JC: Yea.
MK: And, rightly so. I mean that was an extremely insensitive and uncaring
thing to do to viewers. I bring that up because [UI].
JC: Yea. Now, I see your point. Yea.
MK: That was one of the catalysts behind what was going on. Um, with the
emails is that, you know, to sort of say, Look, theres all these gimmicky
things that the station is doing to get you to tune in, and you guys are
kind of suckering yourself into it because youre taking it in, but youre
not being given a fair opportunity to
JC: So, its, its kind of a, in some sense it sounds to me like you were,
you were upset and angry. And, in some sense, its a righteous anger about
some of their actions. Um.
MK: So, I sent emails, you know I was able to obtain emails from a separate
content management system that, again, I still had access to. Um, I dont
ever recall giving that to anybody involved with the Anonymous group.
JC: I think you offered to sell it to them, as I recall, in one of your,
uh, things. Anybody, I think, you told them that you had a list through,
anybody want to buy a list of Fox News?
MK: Yea, my, my, my honest intention was not to sell it to them. It was to
provoke reaction.
JC: Provoke reaction.
MK: Yea. Um, so, right away, that would not have happened.
JC: So, you never gave them the email list other than, and the only way you
used it was
MK: To be completely honest with you, I dont remember if I ever did give
them the email list.
JC: Ok.
MK: I really dont remember.
JC: Alright.
MK: I dont, I have no reason to believe they ever used it for anything,
though.
JC: Ok.
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
52 of 86
JC: Ok.
MK: Um, but, I certainly did have a list. I dont remember, I mean, I
really dont recall if I have that list now.
JC: At, at one point Brandon Mercer, as I understand it, called you up and
confronted you with, uh, these emails, and you said, No, I have nothing to
do with it. Were you still angry with them? What, what was going on then?
MK: I was, um, I was angry with them for a long time.
JC: How do you feel now? Time heals all wounds?
MK: Um. [Pause]. There are days when I look back on it, and I think, you
know, I dont think angry is the right word to use because I wasnt really
angry. I would have been angry if I hadnt prepared for it and didnt know
it was coming and didnt sort of see the warning signs. I was hurt by what
happened. And, thats a word that, you know, in talking with other people
about what had happened with my involvement with Tribune when I was being
interviewed by ABC and when I was being interviewed by Reuters, you know,
the issue did come up, why did you leave? You know, why were let go? And,
you know, how do you feel about it? And, the word that Ive always used,
and I think is most appropriate, was that I felt hurt.
JC: Do you have any regrets, or rem-um, were you sorry now in retrospect
about the whole, you know, doing this kind of hooliganism, and the
MK: It shouldnt have happened. So, yes.
JC: Um
MK: There is some
JC: Because it, it seems like its
MK: Theres some incredible
JC: Theres little payoff for it. It just seems so pointless.
MK: Theres, theres, theres so many incredibly good people that work
there.
JC: Yea.
MK: That still work there. Brandon is one those, I consider Brandon to be
somebody that, you know, he gave me my first opportunity to work in
television, you know, to, to work in news. I wouldnt be here, you know.
, On
10/04/2012
, Page
53 of 86
JC: I read some of those emails. He was, that guy was pretty upset. I mean
he didnt know which way was up with those emails.
MK: Brandon?
JC: Brandon.
[Pause]
JC: If you were given a chance, would you apologize to Brandon about what
you did?
MK: Yea.
JC: Ok.
MK; And, it would be sincere.
JC: I believe it.
MK: The, the hesitation was on two levels. You know, to do anything, and
one was would I be indicting myself. Seems irrelevant at this point. And,
the second is just embarrassment. Of, of, you know, trying to be the, of
wanting, I should say, wanting to be the bigger person and not having been.
JC: Well, heres what I will tell you now and answer to that. First of all,
you know, with regard to, uh, the past or the facts, you cant change what
you did.
MK: Right.
JC: And, you cant change the facts.
MK: I agree, yea.
JC: And, so going forward from where you are sitting right here today
MK: This is one of the reasons why Im talking to you as opposed to saying,
you know, I want a lawyer, or I want to talk to, you know, counsel at
Tribune, or, again Im sorry, Reuters or anything like that is because, you
know, I did it.
JC: I know. And, but more than that the thing, and this brings me to my
second point, is its one thing to know you did it, and theres another
thing to be, uh, to have sufficient character and sufficient humanity
really to just face the truth and do the right thing for the people that
were affected by what you did in the past minor, major, in whatever way.
But, its, its a character issue, and I, and what youre showing me now is
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
54 of 86
But, its, its a character issue, and I, and what youre showing me now is
that you have that character. And, I, I admire that, I think thats, uh, I
think thats a good thing, so.
MK: There are consequences for everything people do, and for what I do, for
what other people have done, you know
JC: Mmm hmm.
MK: -- there are, there were consequences for what happened at Fox. And, my
concern was, you know, in being hurt was that there were not ever going to
be any consequences.
JC: Yea.
MK: And, now, there were.
JC: Yea.
MK: And, by now Im think-Im going to back to my state of mind
JC: Mmm hmm.
MK: -- in December. Now, there were. And, um, it didnt change anything.
JC: Yea.
MK: In terms of, you know, it didnt make me feel better.
JC: I know. Funny how that works, isnt it?
Mk: Of course beforehand I would have had no idea if, if it did or not.
JC: Yea.
MK: But, it didnt make me feel any better, you know, it, it frankly, one
of the reasons why I asked Brandon out to coffee was because I didnt, like
I said, initially, I didnt want there to be any animosity. I just wanted
there to be, you know, I just wanted us to be able to work together again.
JC: Yea.
MK: Whether or not we have friendship or a working business relationship, I
just wanted us to be able to work together again. And, for some of the
people on the staff, we have been working together. You know, Ive
coordinated with their web producer, the person that now has my job, [UI]
two days ago.
JC: Well, I havent phoned Brandon in a while, but I did get to know him
, On
10/04/2012
, Page
55 of 86
JC: Well, I havent phoned Brandon in a while, but I did get to know him
briefly. I talked with him a few times, and he, uh, strikes me as a, uh,
the kind of guy that is not going to hold that against you in a significant
way if, if you were to talk to him and, and essentially apologize.
MK: Brandon is, as a person, he is one of the most generous people youll,
youll meet. Hes one of the nicest people youll meet. Hes one of the
smartest people, frankly.
JC: Mmm hmm.
MK: You know, as a manager, hes lousy. You know, thats
JC: Not surprising how that combination MK: And, its not because he was my boss, you know, and everybody has sort
of animosity towards their boss, but, and, and, you know, America workplace
America. I love the boss that I work with now.
JC: Yea.
MK: Um, but, as a manager, he just wasnt effective. A lot of people, a lot
of good people were being let go that didnt need to be let go because of a
direction that doesnt work. And, still to a certain extent doesnt work.
JC: Yea.
MK: You know, I mean I work in media. We look at each other and, and judge.
We shouldnt, but we do.
JC: Sure.
MK: And, there are still a lot of people that, you know, there are people,
frankly, that I went to a party in December, that December and the
hacking, was hacking, it wasnt hacking. The hacking was, was brought up at
this party, and they were asking me, Who is Fox Mulder? You know,
Whoare you Fox Mulder? and of course I was denying it. And, the
sentiment there was, you know, you say they were terrified. Im surprised
to hear that because when I was at this party, the reaction that I was
getting was its about time. You know, somebody did something.
JC: Yea.
MK: And
JC: Ill, uh, Ill characterize it this way. When I was called in after
MK: I believe that Brandon was terrified. [Laughter]
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
56 of 86
, On
10/04/2012
, Page
57 of 86
MK: The, the people that ABC spoke with when I was being interviewed there
told who would eventually become my manager that I was fired.
JC: Hmm.
MK: And, I had to un-dig that hole, and say, Actually, heres what
happened. And, I appreciate that they gave me that opportunity, but
JC: Hmm.
MK: The I genuinely believe some people were upset. I dont think that
they were, you know, you spoke with them. So, you know.
JC: Yea, I speak to everybody.
MK: Im, Im just coming across this as based on my observation and, and
how I used to work with them, and I still keep in touch with them. They
never came to me and, and, you know, I, I think I know some of the people
that you spoke with.
JC: Well, I mean Im thinking of, uh, and I cant put names to faces, but
Im thinking things of probably like more like secretaries. People that
didnt, that had only been on the periphery, you know, of, uh, what was
going on and knew that this sort of stuff was happening, knew that there
was an issue, felt this un-described kind of threat to the organization and
didnt know where it was coming from.
MK: There were some people that I think genuinely, you know, they love the
brand, they love the company, you can do whatever you want to them and they
are just happy to have a job.
JC: Yea.
MK: You know, and, I understand that. I completely understand that. And, if
theres any sort of fear of, of being terrified its because, you know,
theyre, theyre more afraid of, of the fact
JC: The unknown.
MK: [UI] shake up than they are of what was happening. And, Im just
speaking based on, please dont let me characterize anybody, but Im just
speaking completely
JC: How you perce
MK: as a former employer there
JC: I understand.
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
58 of 86
JC: I understand.
MK: --and understanding how things worked there.
JC: Ok.
MK: Thats, I dont think this is, thats relevant to what were talking
about but, um. So, the reason, the emails, you know, I had access to
emails, to email, to be more specific, I had access to email addresses of
people who may or may not have entered this contest. And, it was based on
credentials that I was given and never were taken away from me.
JC: Ok.
GA: Did the Cash Grab contest [UI] you spoke about before?
MK: No, this contest was [UI] you know in coming up with this contest I
believe was the iPad people [UI].
JC: Yea, yea the IPad, the Christmas, uh
MK: -- it happened in December. Again, it was my idea.
JC: Yea.
MK: [UI]
JC: Uh, are you still in contact with anybody, uh, in, um, Anonymous
hacking realm?
MK: I reached out to Jack Davies, uh, on the advice of Parmy to try and get
him to do a story with, um, my boss who is, uh, a hes, hes a social media
editor at Reuters and he also does technology assignments.
JC: Mmm hmm.
MK: And, I wanted to reach out to him to try to, um, uh, do a story. You
know, he had written up a piece in the Guardian
JC: Yea.
MK: -- that Im sure youve read. Uh, you know, saying, Life is great
without the Internet. Uh, which I would really consider for two weeks.
Its not that bad. [Laughter] You get used to it. Um, I wanted to sort of
talk to him and have my boss talk with him and try and get perspective, you
know, like have a cell phone number that Parmy gave me that I texted and I
said, you know, my name is Matthew, I work for Reuters. Uh, I dont know,
you know, frankly, based on my text that I sent him whether or not he would
, On
10/04/2012
, Page
59 of 86
you know, frankly, based on my text that I sent him whether or not he would
have known who I was.
JC: Yea.
MK: Uh, but I can tell you that I didnt hear anything from him, and I
emailed Parmy, and I said, You know I didnt hear anything from Jack.
Whats going on? And, he, she said, Well, he didnt get your text. And,
I figured, well, its an international number maybe thats why. Um, but,
uh, as far as keeping in touch with anybody with Anonymous
JC: Yea.
MK: Uh, not since, my last involvement with, I want to be very clear when I
say involvement, its more or less observant.
JC: Mmm hmm.
MK: I didnt hack into anything, committed no criminal offense, you know,
as far as I am aware of. Um, I think it was March. May have been January of
2011 was the last time that I was given access to the InternetFeds room.
From that point on, I really didnt go into the chat room, you know. I
would go in every now and then to just kind of see what was going on.
JC: When, when was this? March of this year?
MK: I believe it was no. Uh, January of 2011
JC: Ok.
MK: -- was the last time I was given access to the room.
JC: Alright.
MK: I was in there for about a month. Uh, they shut the room down because
things were being leaked out. By me. You guys [UI]
JC: Yea.
MK: [UI]
JC: Oh yea.
MK: Um, and by that point, the damage that I had done in giving them those
credentials was already
JC: Right.
MK: Done.
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
60 of 86
MK: Done.
JC: And, just to clarify, when you say no criminal intent, I mean, I, I
hope Ive been clear, but, uh, it says at the end of the warrant, it says,
uh, it is, uh, with regard to, you know, giving passwords, thats actually
technically, technically illegal. I mean its, uh
MK: I didnt know that at the time. [Laughter].
JC: And
MK: And, Ive since found out, um, you know, Ive since done more
background research on this.
JC: Ok.
MK: And, um, I dont want to incriminate myself upon, you know, by saying,
I did or did not.
JC: Well, youre not making it worse than it already is or, or less. I mean
it is what it is.
MK: I just want to be honest with you and tell you what happened.
JC: I understand.
MK: You know, as far as any kind of charges or indictment or admission or I
think that will come later in some of the guilt or not. Um, I just want to
tell you what happened.
JC: I understand, and I appreciate that.
MK: And, [UI].
JC: Yea, I mean going with, well, well go back I mean, but I do want to
be clear. I dont want to misinform you because, uh
MK: I understand what you guys have to do.
JC: You know, I mean theres particularly giving passwords, theres the
trafficking passwords. Even taking the email list from Fox News after they
terminated you. You know, thats technically a computer intrusion, and
youre not supposed to do that, and you know, you knew you werent supposed
to do it.
MK: No, what I, I didnt, I didnt know that I wasnt supposed to do it.
What I would say is that my mindset was I had access to things that they
should have taken away.
, On
10/04/2012
, Page
61 of 86
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
62 of 86
JC: Right.
MK: --with the InternetFeds because that was a story that really hadnt
come out. And, Adrian Chen and I had, had traded, um, the Gawker writer,
had traded emails, um, back and forth. I had given him access to some of
the screen grabs. Um, as I did with Parmy and, and a few others.
JC: Mmm hmm.
MK: Some of which I dont remember to be honest with you. Um, and, uh, in
reaching out to you it was for a story.
JC: Ok. I understand.
MK: It was because I was doing a story and as a journalist you have to
reach out to all of the resources you have available, and, um, I, dont get
me wrong, I understand why you werent able to respond. It doesnt surprise
me, frankly. Um, to answer your question about my, you know, going to the
chat rooms and being observant with Anonymous. January 2011 was, as far as
this is concerned, the last time that I went into any chat room or had
access to any chat room I was able to observe InternetFeds.
JC: Ok.
MK: When I was working at ABC, uh, we had Op BART happen in San Francisco.
JC: Ok, yea, yea.
MK: And, I went onto the chat room using a Disney computer and said is
there anybody that would like to talk us about this.
JC: Ok, but as a journalist?
MK: As a journalist. And, one person, and unfortunately, I, you know, I,
Ill be very honest with you, I dont know it was. If I, as far as screen
names or anything like that, you know, if you were to show it to me, I
wouldnt be able to say
JC: Yea.
MK: --you know, who it was. I wouldnt be able to confirm or deny one way
or another.
JC: Yea.
MK: But, to be completely honest with you, as it stands right now, I dont
remember the persons screen name. I dont remember the phone number that,
, On
10/04/2012
, Page
63 of 86
remember the persons screen name. I dont remember the phone number that,
you know, popped up on my caller ID when they called in. I, I genuinely
dont remember any of that.
JC: Ok.
MK: Um, that being said
JC: Alright.
MK: -- if you were to present me with like a chat log and said, What
happened?
JC: Well
MK: I wouldnt be able to confirm or deny one way or another.
JC: Would you be willing at a later time if we did, and you know, a better
venue, sit down and go over some of the chat logs? Uh, to, and explain who
was who that youre recollection and go over some of the names. And, um
MK: I can tell you when I found out who Sabu was it did not surprise me
because he had been very candid with me.
JC: Yea.
MK: In one of our conversations he said, you know, I live in New York. I am
a, he told he was a foster father of two boys, turns out that was
inaccurate.
JC: If it came to a trial or a hearing would you be willing to testify?
MK: On this? Or, on
JC: On anything. I mean
MK: Uh, can I say yes now?
JC: Yea, you can say whatever you want. I mean, its, uh, these are your
own words.
MK: I, I mean, I essentially I dont, I, I dont have full recollection of
JC: Yea.
MK: I can tell you that in terms of Op BART, you know, there was at least
one person that reached out and said
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
64 of 86
, On
10/04/2012
, Page
65 of 86
MK: But, I also understand that in working, you know, in, in, what, what
you guys initially, I think, overall are looking for is information and
evidence.
JC: Thats pretty much it.
MK: Um, I dont think there is, as far as the hacking collective, I dont
think theres really, theres, youre not going to get much from me, you
know. And, its not because
JC: You know.
MK: I dont want to offer it. Its because I cant, you know. And, by I
cant, I mean I dont physically have the ability.
JC: The, the thing that you dont appreciate is you cant, uh, from where
were sitting, get the big picture, and how all of the pieces come
together.
MK: No. I completely understand that anything at this point helps.
JC: Yea.
MK: Believe me. I, Im not ignorant of the fact that any little piece of
the puzzle is going to help put together the bigger picture. And, again,
when you contacted me in April, when I was moving, my intention was not to
hide anything that had happened. I had gotten a new job.
JC: I understand.
MK: All of it. Things for me have been working fine, you know. Even given
this, things for me will still be fine. Um, at some point, you know, what
happened today is not, did not come as a surprise to me.
JC: I, Im sure.
MK: You know.
JC: Why, why dont we do this, why dont you start, uh
MK: But, what Im saying is [UI]. My concern is this eventually getting out
there under my name, um, and I know that there are ways that, you know,
like calling me a cooperating witness or, or something like that. Theres,
whatever in your ability to minimalize
JC: To the, and I, I
MK: [UI] the impact.
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
66 of 86
, On
10/04/2012
, Page
67 of 86
JC: And, it wouldnt be part of, if, if, if and when that you were charged,
it wouldnt be, uh, part of that. And, all of that is going to be done
MK: What do you mean it wouldnt be a part of that?
JC: Well, I mean, it, it wouldnt be incorporated like this as an
affidavit. It, it goes you, you know, you know, [UI].
MK: [UI]. In terms of the writing, Ill write whatever you want me to
write. [Laughter] Thats fine. I dont want to give you a blank check, you
know. So say, and, and make promises at least on my end that you know
JC: Im just giving you an opportunity to, to show remorse, to explain to
the prosecutor and show that Im fully cooperative.
MK: As far as this is concerned, whatever you need from me, you can have.
JC: Alright. Well, lets go ahead and, and
MK: If you want me to, you know. If youre able to get information that
leads you to an arrest of another individual. As a journalist, the
consequences that happened to the people that I write about, and as far as
Im concerned, this to me, is not just a life experience, but its now
become part of a story that
JC: Ok.
MK: Im involved in because I injected myself
JC: Yea.
MK: --into it as of March of last year. Um, my name is out there. People
know that I observed this room. There, there are parts of my observations
that have been published.
JC: Mmm hmm.
MK: Im sure youve read them.
JC: Mmm hmm.
MK: Um, there are parts of them that made it into the book, and youve read
it. [Laughter]. Or, youre getting through it. I have, actually, not read
the entire book myself. Um.
JC: Well, your concern is uh
MK: Two things. Two things. I would rather [UI].
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
68 of 86
, On
10/04/2012
, Page
69 of 86
card, or, or
JC: And, we, we have a card. Were going to leave our cards. And, we will
certainly be in contact afterwards saying weve got to go back to, uh, you
know California, but uh, well be in touch with ya. And, you know, youll
be a dial a
MK: [UI] Jersey
JC: Yea, I could [UI] a nice place in Manhattan.
MK: I have to tell you, I love living here. I have
JC: Well, this is the center of the world.
MK: I have great roommates who will probably leave soon.
JC: Well, hopefully that doesnt, and you know, and, and in retrospect, uh,
and, um, Im going to leave you to write this thing here in a second
because I want to keep these guys out there and not mess up their lives too
much, but you know, theyre going to look at this as a bit of an adventure
as well.
MK: I can tell you I want to write whatever you want me to write in your
presence.
JC: Ok.
MK: Um. I dont know that right now Im in the state of mind where I can,
and its not because I dont want to, its because I want be cognizant of
any event.
JC: Ok.
MK: That you need me to recollect, and I just dont know that
JC: Alright.
MK: As of right now
JC: Youre going to have the presence in mind to remember all of the
details.
MK: I just, I just dont, and I, I
JC: Well
MK: [UI] I ultimately want to make sure that whatever I give you is going
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
70 of 86
MK: [UI] I ultimately want to make sure that whatever I give you is going
to be helpful.
JC: And, and I, I can appreciate that.
MK: And I dont, I dont want to leave any detail out.
JC: Well, let me, theres, theres
MK: I want to have a chance to look at this.
JC: Yea, I appreciate that.
MK: And, refresh my memory to these.
JC: Theres three issues that Id like to give to the prosecutor.
MK: Mmm hmm.
JC: Ok. First of all, uh, you know, Im fully cooperative.
MK: And, I understand that time is of the essence, too.
JC: Nah, kind of the essence. I mean, Id like to do it today. [Laughter]
But, uh
MK: We can do it today.
JC: But, uh
MK: Im just saying, in my pajamas, right now
JC: Yea.
MK: I dont know that I can.
JC: So, there-theres a couple issues Id like to get. One is, Im, Im
cooperative. Two is, yea, I worked at Fox News, and I took the emails.
Three is I gave the passwords to some guys on Anonymous. And, four is Im
sorry, and I regret my actions.
MK: I would like to give you whatever information is going to be helpful.
[UI]
JC: But, I dont want, yea, I dont want to put words in your mouth, or
MK: No, I understand.
JC: But, based on our conversation, I think thats pretty much what we
, On
10/04/2012
, Page
71 of 86
JC: But, based on our conversation, I think thats pretty much what we
talked about.
MK: Yea.
JC: And, it can be as simple as those four lines. But, I want it to be your
words. And, uh
MK: And, if thats what youre looking for, you know, we can put it on
paper now. But, if you want something more detailed.
JC: It doesnt have to be detailed. What Im looking for is
MK: And, the conversation that we had today, as long as it doesnt
interfere with, you know, my work, like I wouldnt be able to leave work at
2 p.m.
JC: Yea.
MK: to say
JC: Yea, what well
MK: Unless there was, in certain circumstances there was a subpoena that I
had to appear in court because, you know, youve caught a guy, and I might
know something about it, and you want to
JC: Were not going to call you at work Matt. What we gotta do is we got to
look at the computers.
MK: What, what Im trying [UI].
JC: [UI]
MK: There are certain, certain, you know, Im going to have to go work
today and say, Something happened. You know. I, I, this is, our
interaction is, its not going to be in a news story unless somebody leaks
it to like Gawker or Fox.
JC: Right.
MK: Or, anything like that. Um, I mean anything can happen like, like you
said. I, I to tell you where Im coming from Im going to have to go into
work today and tell my boss this happened.
JC: Mmm hmm.
MK: It doesnt have to be as detailed, and it wont be because I dont want
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
72 of 86
, On
10/04/2012
, Page
73 of 86
MK: [UI] e-mail leave records. Um, and I would prefer to communicate
JC: Face-to-face like we are now.
MK: Or, by via phone or via Skype or by a [UI]. But, um
JC: I understand.
MK: Im not really concerned about that. As far as copping to what I did,
Im willing to do that.
JC: Ok.
MK: As far as writing something and saying, you know, youre looking for
four lines. I remember about two of those right now and you just said it
about five minutes ago.
JC: I know.
MK: Im willing to do that as well.
JC: Alright.
MK: Um, I would ask that as far as youre able to that this not become a
public issue. Um, I understand that, you know, as somebody that has access
to PACER and other, you know, ways, other, other databases that What I
would like to have happen, ideally, and whats going to happen are probably
two different things. Im very cognizant of that fact. Um, but I think in
speaking with you today, youre more, youre more than willing to advocate
for me.
JC: I am. I am. I understand, and I, I want to make sure I understand your
priorities. Youre, youre
MK: I, I also understand that as far as your abilities theres only so much
that you can do. That is not going to be, and I, I think is where youre
concern is. That is not going to be a deciding factor in how much or how
little Im willing to cooperate as far as how much Im willing to
cooperate.
JC: I understand. And, like I say, I think youve judged me right. I am
not, uh, here to make life difficult for you. I told you that at the
beginning. We, we want you to have a successful career and to be successful
in your endeavors, and we dont want that, um, to be derailed because of
anything. Having said that, [UI] issues resolved, and, and well see where
the chips fall. I mean, um, I cant predict what the future is going to be,
but were not going to go out of our way to hurt your career or your
professional life or anything.
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
74 of 86
, On
10/04/2012
, Page
75 of 86
MK: [UI].
JC: Let me go get them, and you can wait here. Why dont you start on that,
and essentially Ill give you, you can [UI]. One is cooperate.
MK: I will say though as far as [UI].
JC: Yea. Ok, Ill keep it on [UI]. Willing to cooperate, two is I did take
the emails, uh, from, uh
MK: Can I grab that paper from you because Id like to write these down as
youre saying them. Thank you.
GA: Yea, of course.
MK: And, Ill, Ill start a fresh piece [UI].
JC: But, I
the issues
Two is the
emails and
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
76 of 86
, On
10/04/2012
, Page
77 of 86
JC: What well probably, uh, well probably have to figure out how to do
the, the mechanism to do that.
MK: Let me tell you before you leave where, where everything is. Uh,
theres a computer there.
JC: Yup.
MK: Theres an iPad in there. Theres one right there. There should be two
hard drives in that, um, dresser. Uh, the TV has the ability to plug in the
USB drive. There may be one behind the TV. There is a USB drive floating
around here somewhere. Um
JC: Let, let me get the guys who are going to collect it with the camera
and everything
MK: And, Ill tell them [UI].
JC: And, you can tell them where everything is.
JC: Hey guys, sorry to bother you, he needs, uh, hes got a camera, hes
willing to show us where all the stuff is and what were going to take.
UM6: [UI] camera, and hes got the log, so.
JC: Well, lets go.
UM6: Alright.
JC: Sorry, Im sensitive to you sitting out here. [Laughter]
UMS: No, no, no. [UI]
JC: Yea, yea.
UM7: Alright, do we have a garbage bag?
UM8: Whats that? Ill bring one.
UM7: Yea, just put one in the [UI].
JC: Have the roommates taken off?
UM9: Yea, yea, I think they both [UI].
JC: Ok. Are they, uh, calm, or?
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
78 of 86
, On
10/04/2012
, Page
79 of 86
UM11: Do you want us to take overall photos first? Do you guys want to step
outside?
JC: Oh yea, well step back. What, typically what they do here, Matt, is
theyll take overall photos kind of show the layout of the room and
everything.
UM11: [UI]
MK: Uh, Ill get to this, yea, in a second, Ive, Ive gotta
JC; Well, just show them where everything is.
UM12: Yea, so smart phone is right over there.
MK: The smart phone is there.
UM12: Ok.
MK: Um, theres, uh, an Apple iPad in that bag.
UM12: Which bag? Are we talking about the smaller or the large one?
MK: The small one is mine. The large one is [UI].
UM12: Ok, alright. So theres an Apple iPad in there, ok.
MK: Um, there also maybe a USB thumb drive in there.
UM12: Ok.
MK: Um, theres also a Kindle.
UM12: Ok.
MK: I dont know if thats of any interest to you guys.
UM12: K.
MK: Apple i- uh, theres, uh, uh, an Apple iMac right there.
UM12: Mmm hmm.
MK: There are two hard drives in, I believe theyre in this drawer of the
dresser.
UM12: What about this one here? Is that in addition to?
MK: No, Im sorry, this is one of the two. Theres only two total. Theyre
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
80 of 86
MK: No, Im sorry, this is one of the two. Theres only two total. Theyre
both Toshiba.
UM12: Ok.
MK: Um, theres a black one. Theres also a gray one.
UM12: Is this the gray one right here?
MK: Oh, it is. So, theyre both on the dresser.
UM12: Ok.
MK: Um.
UM12: Any thumb drives or anything?
MK: No, but youre welcome to look.
JC: How about behind the TV?
UM12: How about the Western Digital box? Do you have anything stored on
there?
MK: So this is an Apple TV that
UM12: Oh it is? I, it looks like the Western Di
MK: To my knowledge theres nothing stored on it.
UM12: Ok.
MK: Youre welcome to take a look at it if you need to. Uh, if the thumb
drive is not in the I dont want to touch anything. If the thumb drive is
not in that bag, its behind the TV. Its plugged into the TV.
JC: And, wheres the data were looking for, Matt? Which device is it on?
Which, uh, hard drive?
MK: I dont remember which one its on, but its [UI].
JC: One of the hard drives, and is there, which laptop did you actually use
to communicate with, uhMK: For some of it, it is, um
JC: The one in there.
MK: The one in there.
, On
10/04/2012
, Page
81 of 86
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
82 of 86
JC: Yea.
MK: Theres a third computer. I no longer have access to it and that is the
computer that half of the communication took place on. Its since been
crashed because it just didnt work.
JC: Where is that?
MK: Im sorry?
JC: Where is that computer?
MK: Its, its gone. I, I
JC: Oh, you threw it away.
MK: I, I no longer have access to it.
JC: Ok.
MK: Its just gone.
JC: Ok.
MK: Um, that having
JC: Did you sell it? Did throw it away?
MK: That having been said its since been disposed of. That having been
said anything that was on that computer
JC: Is on the hard drive?
MK: Is somewhere on there. So, its in that zip drive that I told you
about.
JC: Alright.
MK: So, I would love to be able to offer that up to you. I just dont have
[UI].
JC: How did you dispose of it?
MK: So, I left it at my grandmothers house.
JC: Ok.
MK: And, she got rid of it.
, On
10/04/2012
, Page
83 of 86
JC: Ok.
MK: Um, and I will call her and ask her.
JC: Alright. Uh.
MK: It may actually, we may actually been able, be able to I dont know
how she got rid of it.
JC: Alright.
MK: Ill ask her, and if its something that I can reasonably get access
to.
JC: Well, we wont reach out to her. I mean, uh, youve asked us not to
contact your family so, uh.
MK: I, I will reach out to her, and if she can give me, if she
JC: Knows where it is.
MK: If she gave it to a relative or knows where it is or, or disposed of
it, I can at least figure out what she did with it. If she threw it in the
trash or [UI].
JC: Alright. So, these we definitely need to take with us.
MK: This one.
JC: What else do we need take?
GA: The laptop out there. I dont think that we need to take this one. Hes
being forthcoming with
MK: Would you like to look at it?
UM13: Um.
JC: Ill, I
GA: I guess I could take a quick look through it while you make your, your
statement.
MK: Sure, thats fine.
JC: And, uh, how about on the thumb drive? Whats on the thumb drive?
MK: Thumb drive is exclusively used for work.
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
84 of 86
, On
10/04/2012
, Page
85 of 86
UMS: Was it formatted or was it wiped like zeroes and ones? I mean, was it,
was it wiped?
MK: I did, um, so theres an option on the Mac, uh, where you can do like a
secure, where it just rewrites the data a bunch of times.
GA: Ok.
MK: I chose that option. I think I got frustrated with how long it took
because that computer is slow, and I canceled out of it and just did a
fresh install.
JC: Alright. Well, well see what, uh, comes up on that.
MK: Yea, youre welcome to take them.
JC: So, its a, uh. Id do the forensics in Sacramento so Im familiar
with, uh, Linux or the HFS. Alright, well, uh, you guys are ready?
UMS: Were ready, yea.
JC: Uh, you, you want to do it out here? Or you wanna
MK: Yea. Can I grab that [UI].
JC: Yea, you can take your affidavit there, search warrant and.
MK: Alright.
JC: [UI]. And, Ill, uh, step out here with you.
MK: Im going [UI] if thats ok?
JC: Thats fine.
MK: [UI]
JC: Yea, why dont you, uh, just pick a chair. Im going to pull this
around for you here on that side so you can sit and take notes.
MK: [UI]
JC: Thats our stuff.
MK: Ok.
JC: Yea, theyre getting ready, were getting ready to, uh Oops, Im
sorry. Im so sorry.
288A-SC-45485
Continuation of FD-302 of
, On
10/04/2012
, Page
86 of 86
sorry. Im so sorry.
UMS: [UI]
JC: Have a seat right there, Matt.
UM14: [UI]
JC: No, I dont think we need that. Thats alright.
GA: Just trying to avoid.
JC: Im going to step out for a second here. [UI] Alright So the time is
8:05 [FBI Note: 1D2 Ends] We started at a roughly a little after 6
am.[FBI Note: 1D1 Ends]
Exhibit A
Jay
Esq.
Jay Leiderman Law
5740 Ralston Street, Suite 300
Ventura, CA 93003
Date
November 2, 2010
November 2010
November 29, 2010
December 12, 2010
December 13,2010
December 15, 2010
Place
Shadow Tree Drive, Apt. 327, Sacramento,
Shadow Tree Drive, Apt. 327, Sacramento,
Shadow Tree Drive, Apt. 327, Sacramento,
Shadow Tree Drive, Apt. 327, Sacramento,
3381 Shadow Tree Drive, Apt. 327, Sacramento,
Shadow Tree Drive, Apt. 327, Sacramento,
California
California
California
California
California
California
Rule
requires your response within
days of the government's request, or at some
other time as the Court sets; please notify us i f you seek additional time to respond.
James Silver
Deputy Chief for Litigation
Cc: